Create or update a registry user

PUT

https://api.confirm.global/partner/v1/users

Keeps registry user accounts in sync with yours, so a user’s first sign-in to CONFIRM is instant rather than provisioned on the spot.

Identity is keyed on your user ID. Matching is by external_user_ref first, then by email (case-insensitive). That ordering is what makes an email or name change on your side update the existing account — this endpoint can never produce a duplicate.

Permissions are not synced. Your system tells us who a user is and which registry they belong to; what they can do inside CONFIRM is governed by CONFIRM roles, managed in the portal. Role changes on your side are deliberately ignored.

Keeps registry user accounts in sync with yours, so a user's first sign-in to CONFIRM is instant rather than provisioned on the spot. **Identity is keyed on your user ID.** Matching is by `external_user_ref` first, then by email (case-insensitive). That ordering is what makes an email or name change on your side *update* the existing account — this endpoint can never produce a duplicate. **Permissions are not synced.** Your system tells us who a user is and which registry they belong to; what they can do inside CONFIRM is governed by CONFIRM roles, managed in the portal. Role changes on your side are deliberately ignored.

Authentication

AuthorizationBearer

Partner API key sent as Authorization: Bearer cfk_.... Keys are partner-level — one key reaches every registry linked to your partner account and nothing else. CONFIRM issues and revokes them; a key is shown exactly once at creation because only its hash is stored, and revocation takes effect on the next request. Develop against the sandbox base URL with a sandbox key, where telephony is restricted to an allowlist you provide.

Partner API key sent as `Authorization: Bearer cfk_...`. Keys are partner-level — one key reaches every registry linked to your partner account and nothing else. CONFIRM issues and revokes them; a key is shown exactly once at creation because only its hash is stored, and revocation takes effect on the next request. Develop against the sandbox base URL with a sandbox key, where telephony is restricted to an allowlist you provide.

Request

This endpoint expects an object.

external_user_refstringRequired

Your identifier for this user. The primary identity key.

organization_refstringRequired

The registry this user belongs to.

emailstringRequiredformat: "email"

first_namestringOptional

last_namestringOptional

Response

An existing account was updated.

user_idstringformat: "uuid"

external_user_refstring

Your user identifier, echoed back.

emailstringformat: "email"

organization_refstringOptional

createdbooleanOptional

False when an existing account was updated instead.

Errors

400

Bad Request Error

401

Unauthorized Error

404

Not Found Error

429

Too Many Requests Error

$	curl -X PUT https://api.confirm.global/partner/v1/users \
>	-H "Authorization: Bearer <token>" \
>	-H "Content-Type: application/json" \
>	-d '{
>	"external_user_ref": "cl_user_5512",
>	"organization_ref": "cl_biz_4471",
>	"email": "jeff@suncoastnurses.com"
>	}'

1	{
2	"user_id": "string",
3	"external_user_ref": "cl_user_5512",
4	"email": "string",
5	"organization_ref": "cl_biz_4471",
6	"created": true
7	}