Manager Users

Role names and user_group_id values are listed in User groups.

Administrative endpoints for managing user accounts. Requires manager or administrator role.

Requests made by an External Auditor (user_group_id 250 — Auditor) have email, phone, phone2, address, city, pc and passport stripped (returned as null) from every User/UserDetail object in the response, except the auditor's own record. This applies to every endpoint on this page — list, view, everything — automatically, based on the caller's role, not the target user's.

List Users

GET /manager/users.json

Retrieve all users in the company.

Response

[
  {
    "User": {
      "id": "123",
      "active": true,
      "email_status": "confirmed",
      "pilot": true,
      "two_factor": "OFF",
      "api": false,
      "email": "[e-mail]",
      "user_group_id": "110",
      "expiration": null
    },
    "UserDetail": {
      "name": "John",
      "surname": "Doe",
      "photo": "https://..."
    },
    "UserGroup": {
      "name": "Pilot",
      "id": "110"
    }
  }
]

---

Users List (Simplified)

GET /manager/users/list.json

Retrieve a simplified user list (ID to name mapping). Useful for dropdowns.

Response

{
  "123": { "name": "John Doe" },
  "124": { "name": "Jane Smith" }
}

---

View User

GET /manager/users/view/{id}.json

Retrieve full user details including login history and company context.

Path Parameters

Parameter	Type	Description
id	string	User ID

Response

{
  "user": {
    "User": {
      "id": "123",
      "base_id": "5",
      "user_group_id": "110",
      "active": true,
      "pilot": true,
      "api": false,
      "email_status": "confirmed",
      "email": "[e-mail]",
      "expiration": null,
      "user_login_count": "42",
      "created": "2023-01-15"
    },
    "UserDetail": {
      "id": "123",
      "name": "John",
      "surname": "Doe",
      "color": "#3498db",
      "photo": "https://...",
      "dob": "1990-05-20",
      "address": "123 Airport Road",
      "city": "Madrid",
      "pc": "28001",
      "phone": "600123456",
      "passport": "AB123456",
      "companyid": "EMP-001",
      "country_id": "195",
      "timezone_id": "85"
    },
    "UserGroup": { "id": "110", "name": "Pilot" },
    "Company": { "name": "Acme Flight School", "id": "42" },
    "UserLogin": [
      {
        "id": "999",
        "user_id": "123",
        "city": "Madrid",
        "country": "Spain",
        "provider": "Chrome",
        "browser": "Chrome 120",
        "ip": "192.168.1.1",
        "modified": "2025-03-10 08:00:00"
      }
    ]
  },
  "mycompany": {
    "Company": {
      "id": "42",
      "name": "Acme Flight School",
      "plan": "premium",
      "type": "flight_school",
      "user_count": "50",
      "expiration": "2026-01-01"
    }
  },
  "languages": { "en": "English", "es": "Español" },
  "bases": { "5": "Madrid Base", "6": "Barcelona Base" }
}

---

Create User

POST /manager/users/create.json

Create a new user account. This is also how pilot and student accounts are created (the NEO Add Pilot form and Import both post here).

Permissions

• Restricted to user_group_id ∈ {1, 100, 105, 110, 120} (Company Administrators, Operations Managers, Compliance & Safety Managers and Human Resources Managers). Every other group, including Chief Pilots (150), gets 403 "You are not allowed to create users".

• User.user_group_id is required and must be between 100 and 300; it can never be more senior (lower) than the caller's own group.

• On the free plan, creating a pilot (user_group_id 151–299) is refused with 400 once the company has more than 100 pilots.

Request Body

Fields should match the user and user detail structure (email, name, surname, user_group_id, etc.).

Response

{
  "success": true,
  "result": true,
  "user_id": "125",
  "message": "User created successfully"
}

Validation Errors

{
  "success": false,
  "errors": {
    "email": ["This email is already registered"],
    "UserDetail": {
      "country_id": ["Country is required"]
    }
  }
}

External Auditor accounts (user_group_id: 250)

Auditor accounts are always temporary, external, read-only. These rules are enforced server-side on both create and edit — they cannot be bypassed by the client:

• pilot is forced to false. Auditors never have flying privileges.

• expiration is required and must be no more than 90 days from the time of the request. Validation errors: "Auditor accounts must have an expiration date", "Expiration date must be in the future", "Auditor accounts cannot be granted for more than 90 days from today".

• Two-factor authentication is forced to EMAIL — an auditor's credential can never be switched to TOTP or OFF, regardless of which endpoint attempts it.

{
  "success": false,
  "errors": {
    "expiration": ["Auditor accounts cannot be granted for more than 90 days from today"]
  }
}

---

Edit User

POST /manager/users/edit.json

Update an existing user account. The same External Auditor account validation described under Create User above applies here too.

---

Delete User

POST /manager/users/delete/{id}.json

Delete a user account. Requires confirmation.

Path Parameters

Parameter	Type	Description
id	string	User ID

Request Body

Field	Type	Required	Description
confirm	boolean	Yes	Must be true to confirm deletion

---

Resend Activation

POST /pilots/reminder.json

Resend the activation/welcome email to a user.

Request Body

Field	Type	Required	Description
user	string	Yes	User ID

---

Billing Pilots

GET /manager/bills/pilots.json

Retrieve pilot list for billing operations.

Response

Same structure as pilot list endpoint.