/v1/users routes

These routes use a secret key: Authorization: Bearer fc_sk_live_xxx. They only see users of the app that owns the key, and they never return face descriptors.

The user object

{
  "id": "usr_...",
  "email": "ada@example.com",
  "name": "Ada",
  "created_at": "2026-10-14T12:00:00.000Z",
  "last_sign_in_at": "2026-10-14T12:30:00.000Z"
}

last_sign_in_at is null if the user has not signed in since enrolling.

List users

GET /v1/users?limit=50&cursor=...

curl "https://api.facecard.dev/v1/users?limit=50" \
  -H "Authorization: Bearer fc_sk_live_xxx"

{
  "users": [ { "id": "usr_...", "email": "ada@example.com", "name": "Ada", "created_at": "...", "last_sign_in_at": null } ],
  "next_cursor": "<jwt>"
}

next_cursor is null on the last page. Users are ordered by creation time.

Get a user

GET /v1/users/{id} returns one user object.

curl https://api.facecard.dev/v1/users/usr_123 \
  -H "Authorization: Bearer fc_sk_live_xxx"

Delete a user

DELETE /v1/users/{id} deletes the user, every face template, the consent record and challenge rows. A tombstone auth event without personal data is kept. Returns 204 No Content.

curl -X DELETE https://api.facecard.dev/v1/users/usr_123 \
  -H "Authorization: Bearer fc_sk_live_xxx"

Use this to honor a deletion request from one of your users. See Security and privacy.

Errors