emailstring email required
avatarUrlstring required
Empty when no upload; otherwise /api/v1/users/{id}/avatar
hasPasswordboolean required
False for OAuth-only users (no password set). The hash itself is never returned.
emailVerifiedboolean required
Whether the address has been confirmed. Currently a soft gate -
every endpoint still works for an unverified user - so treat it
as a prompt to nudge, not as an authorization signal.
pendingEmailstring email
Present while an email change waits for confirmation. email
stays the current address until the link sent to this one is
opened.
twoFactorEnabledboolean required
Whether the user has two-factor sign-in on. Managed from
Settings → Security through session-only routes (/me/2fa*);
personal access tokens and MCP tokens are not affected by it.
newsletterSubscribedboolean required
emailNotificationsboolean required
Whether card-activity emails are sent (mentions, assignments,
and activity on followed cards that stays unread for a few
minutes). Defaults to true. Account email such as password
resets is always sent.
newsletterAvailableboolean required
False when the newsletter feature isn't configured on the
deployment at all, which is different from being unsubscribed.
isSuperAdminboolean required
Whether the user can reach the /admin dashboard. Informational
only - the real gate is server-side, and the admin endpoints are
session-authenticated, so a token cannot use them.
csrfTokenstring
Present only for cookie/session callers, who need it to send
mutations. Omitted for bearer-token callers, since CSRF does not
apply to a credential that isn't attached automatically.