{
  "type": "array",
  "items": {
    "type": "object",
    "properties": {
      "label": {
        "type": "string",
        "nullable": true
      },
      "token": {
        "type": "string",
        "description": "The access token"
      },
      "object": {
        "type": "string"
      },
      "scopes": {
        "type": "array",
        "items": {
          "type": "string"
        },
        "description": "The list of scopes that the token is valid for.\nOnly present for OAuth 2.0 tokens."
      },
      "provider": {
        "type": "string",
        "description": "The ID of the provider"
      },
      "token_secret": {
        "type": "string",
        "description": "The token secret. Only present for OAuth 1.0 tokens."
      },
      "public_metadata": {
        "type": "object"
      },
      "external_account_id": {
        "type": "string",
        "description": "External account ID"
      }
    }
  }
}

{
  "type": "array",
  "items": {
    "$ref": "#/components/schemas/User"
  }
}

{
  "type": "object",
  "properties": {
    "public_metadata": {
      "type": "object",
      "description": "Metadata saved on the user, that is visible to both your frontend and backend.\nThe new object will be merged with the existing value."
    },
    "unsafe_metadata": {
      "type": "object",
      "description": "Metadata saved on the user, that can be updated from both the Frontend and Backend APIs.\nThe new object will be merged with the existing value.\n\nNote: Since this data can be modified from the frontend, it is not guaranteed to be safe."
    },
    "private_metadata": {
      "type": "object",
      "description": "Metadata saved on the user that is only visible to your backend.\nThe new object will be merged with the existing value."
    }
  }
}

{
  "type": "object",
  "properties": {
    "file": {
      "type": "string",
      "format": "binary"
    }
  }
}

{
  "type": "object",
  "properties": {
    "password": {
      "type": "string",
      "nullable": true,
      "description": "The plaintext password to give the user.\nMust be at least 8 characters long, and can not be in any list of hacked passwords."
    },
    "username": {
      "type": "string",
      "nullable": true,
      "description": "The username to give to the user.\nIt must be unique across your instance."
    },
    "last_name": {
      "type": "string",
      "nullable": true,
      "description": "The last name to assign to the user"
    },
    "created_at": {
      "type": "string",
      "description": "A custom date/time denoting _when_ the user signed up to the application, specified in RFC3339 format (e.g. `2012-10-20T07:15:20.902Z`)."
    },
    "first_name": {
      "type": "string",
      "nullable": true,
      "description": "The first name to assign to the user"
    },
    "external_id": {
      "type": "string",
      "nullable": true,
      "description": "The ID of the user as used in your external systems or your previous authentication solution.\nMust be unique across your instance."
    },
    "totp_secret": {
      "type": "string",
      "description": "In case TOTP is configured on the instance, you can provide the secret to enable it on the specific user without the need to reset it.\nPlease note that currently the supported options are:\n* Period: 30 seconds\n* Code length: 6 digits\n* Algorithm: SHA1"
    },
    "backup_codes": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "If Backup Codes are configured on the instance, you can provide them to enable it on the specific user without the need to reset them.\nYou must provide the backup codes in plain format or the corresponding bcrypt digest."
    },
    "password_digest": {
      "type": "string",
      "description": "In case you already have the password digests and not the passwords, you can use them for the newly created user via this property.\nThe digests should be generated with one of the supported algorithms.\nThe hashing algorithm can be specified using the `password_hasher` property."
    },
    "password_hasher": {
      "enum": [
        "argon2i",
        "argon2id",
        "bcrypt",
        "bcrypt_sha256_django",
        "md5",
        "pbkdf2_sha256",
        "pbkdf2_sha256_django",
        "pbkdf2_sha1",
        "phpass",
        "scrypt_firebase",
        "scrypt_werkzeug",
        "sha256"
      ],
      "type": "string",
      "description": "The hashing algorithm that was used to generate the password digest.\nThe algorithms we support at the moment are [bcrypt](https://en.wikipedia.org/wiki/Bcrypt), [bcrypt_sha256_django](https://docs.djangoproject.com/en/4.0/topics/auth/passwords/),\n[md5](https://en.wikipedia.org/wiki/MD5), pbkdf2_sha256, [pbkdf2_sha256_django](https://docs.djangoproject.com/en/4.0/topics/auth/passwords/),\n[phpass](https://www.openwall.com/phpass/), [scrypt_firebase](https://firebaseopensource.com/projects/firebase/scrypt/),\n[sha256](https://en.wikipedia.org/wiki/SHA-2), [scrypt_werkzeug](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.security.generate_password_hash)\nand the [argon2](https://argon2.online/) variants argon2i and argon2id.\n\nIf you need support for any particular hashing algorithm, [please let us know](https://clerk.com/support).\n\nNote: for password hashers considered insecure (at this moment MD5 and SHA256), the corresponding user password hashes will be transparently migrated to Bcrypt (a secure hasher) upon the user's first successful password sign in.\nInsecure schemes are marked with `(insecure)` in the list below.\n\nEach of the supported hashers expects the incoming digest to be in a particular format. Specifically:\n\n**bcrypt:** The digest should be of the following form:\n\n`$<algorithm version>$<cost>$<salt & hash>`\n\n**bcrypt_sha256_django:** This is the Django-specific variant of Bcrypt, using SHA256 hashing function. The format should be as follows (as exported from Django):\n\n`bcrypt_sha256$$<algorithm version>$<cost>$<salt & hash>`\n\n**md5** (insecure): The digest should follow the regular form e.g.:\n\n`5f4dcc3b5aa765d61d8327deb882cf99`\n\n**pbkdf2_sha256:** This is the PBKDF2 algorithm using the SHA256 hashing function. The format should be as follows:\n\n`pbkdf2_sha256$<iterations>$<salt>$<hash>`\n\nNote: Both the salt and the hash are expected to be base64-encoded.\n\n**pbkdf2_sha256_django:** This is the Django-specific variant of PBKDF2 and the digest should have the following format (as exported from Django):\n\n`pbkdf2_sha256$<iterations>$<salt>$<hash>`\n\nNote: The salt is expected to be un-encoded, the hash is expected base64-encoded.\n\n**pbkdf2_sha1:** This is similar to pkbdf2_sha256_django, but with two differences:\n1. uses sha1 instead of sha256\n2. accepts the hash as a hex-encoded string\n\nThe format is the following:\n\n`pbkdf2_sha1$<iterations>$<salt>$<hash-as-hex-string>`\n\n**phpass:** Portable public domain password hashing framework for use in PHP applications. Digests hashed with phpass have the following sections:\n\nThe format is the following:\n\n`$P$<rounds><salt><encoded-checksum>`\n\n- $P$ is the prefix used to identify phpass hashes.\n- rounds is a single character encoding a 6-bit integer representing the number of rounds used.\n- salt is eight characters drawn from [./0-9A-Za-z], providing a 48-bit salt.\n- checksum is 22 characters drawn from the same set, encoding the 128-bit checksum with MD5.\n\n**scrypt_firebase:** The Firebase-specific variant of scrypt.\nThe value is expected to have 6 segments separated by the $ character and include the following information:\n\n_hash:_ The actual Base64 hash. This can be retrieved when exporting the user from Firebase.\n_salt:_ The salt used to generate the above hash. Again, this is given when exporting the user.\n_signer key:_ The base64 encoded signer key.\n_salt separator:_ The base64 encoded salt separator.\n_rounds:_ The number of rounds the algorithm needs to run.\n_memory cost:_ The cost of the algorithm run\n\nThe first 2 (hash and salt) are per user and can be retrieved when exporting the user from Firebase.\nThe other 4 values (signer key, salt separator, rounds and memory cost) are project-wide settings and can be retrieved from the project's password hash parameters.\n\nOnce you have all these, you can combine it in the following format and send this as the digest in order for Clerk to accept it:\n\n`<hash>$<salt>$<signer key>$<salt separator>$<rounds>$<memory cost>`\n\n**scrypt_werkzeug:** The Werkzeug-specific variant of scrypt.\n\nThe value is expected to have 3 segments separated by the $ character and include the following information:\n\n_algorithm args:_ The algorithm used to generate the hash.\n_salt:_ The salt used to generate the above hash.\n_hash:_ The actual Base64 hash.\n\nThe algorithm args are the parameters used to generate the hash and are included in the digest.\n\n**argon2i:** Algorithms in the argon2 family generate digests that encode the following information:\n\n_version (v):_ The argon version, version 19 is assumed\n_memory (m):_ The memory used by the algorithm (in kibibytes)\n_iterations (t):_ The number of iterations to perform\n_parallelism (p):_ The number of threads to use\n\nParts are demarcated by the `$` character, with the first part identifying the algorithm variant.\nThe middle part is a comma-separated list of the encoding options (memory, iterations, parallelism).\nThe final part is the actual digest.\n\n`$argon2i$v=19$m=4096,t=3,p=1$4t6CL3P7YiHBtwESXawI8Hm20zJj4cs7/4/G3c187e0$m7RQFczcKr5bIR0IIxbpO2P0tyrLjf3eUW3M3QSwnLc`\n\n**argon2id:** See the previous algorithm for an explanation of the formatting.\n\nFor the argon2id case, the value of the algorithm in the first part of the digest is `argon2id`:\n\n`$argon2id$v=19$m=64,t=4,p=8$Z2liZXJyaXNo$iGXEpMBTDYQ8G/71tF0qGjxRHEmR3gpGULcE93zUJVU`\n\n**sha256** (insecure): The digest should be a 64-length hex string, e.g.:\n\n`9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08`"
    },
    "public_metadata": {
      "type": "object",
      "description": "Metadata saved on the user, that is visible to both your Frontend and Backend APIs"
    },
    "unsafe_metadata": {
      "type": "object",
      "description": "Metadata saved on the user, that can be updated from both the Frontend and Backend APIs.\nNote: Since this data can be modified from the frontend, it is not guaranteed to be safe."
    },
    "private_metadata": {
      "type": "object",
      "description": "Metadata saved on the user, that is only visible to your Backend API"
    },
    "profile_image_id": {
      "type": "string",
      "nullable": true,
      "description": "The ID of the image to set as the user's profile image"
    },
    "delete_self_enabled": {
      "type": "boolean",
      "nullable": true,
      "description": "If true, the user can delete themselves with the Frontend API."
    },
    "skip_password_checks": {
      "type": "boolean",
      "nullable": true,
      "description": "Set it to `true` if you're updating the user's password and want to skip any password policy settings check. This parameter can only be used when providing a `password`."
    },
    "primary_web3_wallet_id": {
      "type": "string",
      "description": "The ID of the web3 wallets to set as primary.\nIt must be verified, and present on the current user."
    },
    "primary_phone_number_id": {
      "type": "string",
      "description": "The ID of the phone number to set as primary.\nIt must be verified, and present on the current user."
    },
    "primary_email_address_id": {
      "type": "string",
      "description": "The ID of the email address to set as primary.\nIt must be verified, and present on the current user."
    },
    "sign_out_of_other_sessions": {
      "type": "boolean",
      "nullable": true,
      "description": "Set to `true` to sign out the user from all their active sessions once their password is updated. This parameter can only be used when providing a `password`."
    },
    "create_organization_enabled": {
      "type": "boolean",
      "nullable": true,
      "description": "If true, the user can create organizations with the Frontend API."
    },
    "notify_primary_email_address_changed": {
      "type": "boolean",
      "default": false,
      "description": "If set to `true`, the user will be notified that their primary email address has changed.\nBy default, no notification is sent."
    }
  }
}

{
  "type": "object",
  "required": [
    "password"
  ],
  "properties": {
    "password": {
      "type": "string",
      "description": "The user password to verify"
    }
  }
}

{
  "type": "object",
  "properties": {
    "verified": {
      "type": "boolean",
      "nullable": false
    }
  }
}

{
  "type": "object",
  "required": [
    "code"
  ],
  "properties": {
    "code": {
      "type": "string",
      "description": "The TOTP or backup code to verify"
    }
  }
}

{
  "type": "object",
  "properties": {
    "verified": {
      "type": "boolean",
      "nullable": false
    },
    "code_type": {
      "enum": [
        "totp",
        "backup_code"
      ],
      "type": "string",
      "nullable": false
    }
  }
}

{
  "type": "object",
  "required": [
    "status",
    "strategy",
    "nonce"
  ],
  "properties": {
    "nonce": {
      "enum": [
        "nonce"
      ],
      "type": "string"
    },
    "status": {
      "enum": [
        "verified"
      ],
      "type": "string"
    },
    "attempts": {
      "type": "integer",
      "nullable": true
    },
    "strategy": {
      "enum": [
        "web3_metamask_signature"
      ],
      "type": "string"
    },
    "expire_at": {
      "type": "integer",
      "nullable": true
    }
  }
}

{
  "type": "object",
  "required": [
    "object",
    "web3_wallet",
    "verification",
    "created_at",
    "updated_at"
  ],
  "properties": {
    "id": {
      "type": "string"
    },
    "object": {
      "enum": [
        "web3_wallet"
      ],
      "type": "string",
      "description": "String representing the object's type. Objects of the same type share the same value.\n"
    },
    "created_at": {
      "type": "integer",
      "format": "int64",
      "description": "Unix timestamp of creation\n"
    },
    "updated_at": {
      "type": "integer",
      "format": "int64",
      "description": "Unix timestamp of creation\n"
    },
    "web3_wallet": {
      "type": "string"
    },
    "verification": {
      "type": "object",
      "oneOf": [
        {
          "$ref": "#/components/schemas/Web3Signature"
        },
        {
          "$ref": "#/components/schemas/Admin"
        }
      ],
      "nullable": true
    }
  }
}

{
  "type": "object",
  "required": [
    "object",
    "name",
    "last_used_at",
    "verification"
  ],
  "properties": {
    "id": {
      "type": "string"
    },
    "name": {
      "type": "string"
    },
    "object": {
      "enum": [
        "web3_wallet"
      ],
      "type": "string",
      "description": "String representing the object's type. Objects of the same type share the same value.\n"
    },
    "last_used_at": {
      "type": "integer",
      "format": "int64",
      "description": "Unix timestamp of when the passkey was last used.\n"
    },
    "verification": {
      "type": "object",
      "oneOf": [
        {
          "$ref": "#/components/schemas/Passkey"
        }
      ],
      "nullable": true
    }
  }
}