Imported from L3-iGrant/skills (apis/igrantio-api-user-management/SKILL.md). Install upstream with npx skills add L3-iGrant/skills --skill igrantio-api-user-management. Copyright stays with the author (Apache-2.0).

iGrant.io OID4VC API - User Management

When to use

Use this skill when the task is one of these:

• Read or update the profile of the signed-in admin.
• Read or update the avatar image of the signed-in admin.
• Change the password of the signed-in admin.
• Read which login methods the signed-in admin has.
• Link an EUDI Wallet for passwordless login, with a PID (Person Identification Data) credential or an iGrant.io Authenticator credential.
• Remove a passwordless-login method.

This group is the API behind the Manage User page of the iGrant.io dashboard. Every operation acts on the account that owns the access token. To manage the other admins of the organisation, use igrantio-api-team-management.

Prerequisites

• An iGrant.io Organisation Wallet Suite (OWS) API key. Get it from support@igrant.io. Keep it on the server, in an environment variable or a secret manager. The browser never sees it.
• The OWS environment the key belongs to. The default is demo (https://demo-api.igrant.io). Use staging (https://staging-api.igrant.io) only when the integrator asks for it. A key works only in its own environment.

Ask the integrator first

Ask one question at a time. Wait for the answer. Give the recommended default with each question. Look up facts in the project (framework, environment variables, an existing backend) instead of asking for them. Record the answers before you write code.

1. Environment - demo or staging? Default demo (https://demo-api.igrant.io); a switch later is a configuration change.
2. API key - do you have the OWS API key for that environment? If not, request it from support@igrant.io before you continue.
3. Operation - profile, avatar, password, or passwordless-login methods?
4. Login method - a PID credential or an iGrant.io Authenticator credential?

Endpoint reference

Base URL for the demo environment: https://demo-api.igrant.io.

Twelve operations. Note the version split: the profile, avatar, and password operations live under /v2/onboard/...; the authentication operations live under /v3/config/admin/authentication/....

Authentication and permission

Every operation accepts a bearer access token and acts on the admin that owns the token. Send it as Authorization: Bearer <token>. There is no adminId path parameter in this group.

For the SSE operations, the dashboard opens the stream with the token in a query parameter: ?authorization=Bearer <token>. Use this form when your SSE client cannot set the Authorization header.

Key fields and operations

Profile

GET /v2/onboard/admin gives {"organisationAdmin": {...}} with id, email, name, phone, roleId, roleName, avatarImageId, avatarImageUrl, and lastVisited. Update with PUT /v2/onboard/admin and the body {"organisationAdmin": {"name": "...", ...}}.

Avatar image

GET /v2/onboard/admin/avatarimage gives the binary image data; read it as a byte stream, not as JSON. PUT takes multipart/form-data with the image in the avatarimage field, and gives the updated organisationAdmin.

Password

PUT /v2/onboard/password/reset with the body {"currentPassword": "...", "newPassword": "..."}. Both fields are mandatory.

Authentication configuration

GET /v3/config/admin/authentication/user gives {"authentication": {...}}:

Link a wallet with a PID credential

1. GET .../oidc/user/verify gives vpTokenQrCode (a QR code for the wallet) and presentationExchangeId.
2. Open GET .../oidc/user/verify/sse and wait for data: {"verified": true}. The connection stays alive with : keep-alive comments and closes on success or timeout.
3. The admin scans the QR code with the EUDI Wallet and presents the PID credential. A successful presentation links the wallet.

DELETE .../oidc/user/verify removes the PID login method (HTTP 204).

Link a wallet with an iGrant.io Authenticator credential

1. GET .../oidc/user/authenticator gives credentialOffer (a credential offer URI), credentialExchangeId, and pin (a one-time PIN).
2. Open GET .../oidc/user/authenticator/sse and wait for data: {"accepted": true}.
3. The admin scans the credential offer with the wallet and enters the PIN to accept the credential.

DELETE .../oidc/user/authenticator removes the Authenticator login method (HTTP 204).

Validation / done criteria

• You read the avatar as binary data, not as JSON.
• You send both currentPassword and newPassword on the password change.
• Your PID and Authenticator flows open the SSE stream before the admin scans, and they test for {"verified": true} or {"accepted": true}.
• You test for HTTP 204 on the two remove operations.
• You use igrantio-api-team-management to turn passwordless login on or off; this group only links or removes the methods of the signed-in admin.

Documentation is the source of truth

This skill mirrors the iGrant.io OID4VC API documentation. If this skill and the linked documentation disagree - on a path, a field name, an enum value, or a mandatory field - the documentation wins. Fetch the linked page for the operation, or the raw specification at https://docs.igrant.io/openapispecifications/oid4vc.yaml, to check for an update. Follow the documentation, and report the difference so that this skill can be corrected.

Cross-references

• igrantio-api-team-management - create, delete, and list the admins of the organisation, and the passwordless-login switch per admin.
• igrantio-api-holder - receive and present credentials in a wallet.
• igrantio-credential-schema-authenticator - the iGrant.io Authenticator credential schema.