Create or update a registry user
Keeps registry user accounts in sync with yours, so a user’s first sign-in to CONFIRM is instant rather than provisioned on the spot.
Also reactivates. Sending a user you deactivated with
DELETE /users/{external_user_ref} brings back the same account
(200, created: false).
Users in several registries. Send the user once per registry, with
the same external_user_ref and a different organization_ref. Each
call adds that registry to the same account; nothing is moved, and a
single CareLink sign-in reaches every registry the user belongs to.
Signing in through a registry’s link opens that registry; a user who
isn’t a member of it is told they don’t have access.
DELETE /users/{external_user_ref}?organization_ref= removes one
registry and leaves the others.
Identity is keyed on your user ID. Matching is by
external_user_ref first, then by email (case-insensitive). That
ordering is what makes an email or name change on your side update the
existing account — this endpoint can never produce a duplicate.
Permissions are not synced. Your system tells us who a user is and which registry they belong to; what they can do inside CONFIRM is governed by CONFIRM roles, managed in the portal. Role changes on your side are deliberately ignored.
Authentication
Partner API key sent as Authorization: Bearer cfk_.... Keys are partner-level — one key reaches every registry linked to your partner account and nothing else. CONFIRM issues and revokes them; a key is shown exactly once at creation because only its hash is stored, and revocation takes effect on the next request. Develop against the sandbox base URL with a sandbox key, where telephony is restricted to an allowlist you provide.
Request
A registry this user belongs to. Sending the same user for another registry adds that registry; it doesn’t move them.
Response headers
The ID of this request. On an error it equals request_id in the body. If you sent an X-Request-Id, it is your value, returned unchanged. Log it, and quote it when contacting CONFIRM support.
Response
Account created. Sending an existing external_user_ref or email returns 200 and updates that account.