Users

Users are the people on your site: your customers and your support staff. With the API you can look people up, add them, update their details and choose which categories email them about every new discussion.

Examples use your token in $TENDER_TOKEN (see Authentication). Writes need a token with Read and write access.

List users

curl -H "Accept: application/vnd.tender-v1+json" \
     -H "Authorization: Bearer $TENDER_TOKEN" \
     https://api.tenderapp.com/yoursite/users

{
  "users": [
    {
      "name": "Lucas Moreau",
      "email": "lucas@northwind.example.com",
      "state": "user",
      "title": null,
      "company_id": 2,
      "discussions_count": 3,
      "comments_count": 4,
      "href": "https://api.tenderapp.com/yoursite/users/14",
      "discussions_href": "https://api.tenderapp.com/yoursite/users/14/discussions{?page,user_email}"
    }
  ],
  "offset": 0,
  "total": 10,
  "per_page": 30
}

Users come 30 to a page; ask for the next with ?page=2.

Find someone by email

email finds the user with that address. It matches any of their addresses, not only the main one.

curl -H "Accept: application/vnd.tender-v1+json" \
     -H "Authorization: Bearer $TENDER_TOKEN" \
     "https://api.tenderapp.com/yoursite/users?email=lucas@northwind.example.com"

The answer is a list as above, with one user in it, or none.

Filter the list

filter picks which users to list. Without it you get visible.

filter	who
visible	customers, support staff and people who have only written in by email
all	everyone, including disabled users and spammers
support	your support staff
active	customers and people who have only written in by email (no support staff)
disabled	disabled users and spammers
beta	users with beta access
important	users with important access

curl -H "Accept: application/vnd.tender-v1+json" \
     -H "Authorization: Bearer $TENDER_TOKEN" \
     "https://api.tenderapp.com/yoursite/users?filter=support"

Use one of these names exactly: any other value fails with an error.

Get one user

curl -H "Accept: application/vnd.tender-v1+json" \
     -H "Authorization: Bearer $TENDER_TOKEN" \
     https://api.tenderapp.com/yoursite/users/14

{
  "name": "Lucas Moreau",
  "email": "lucas@northwind.example.com",
  "created_at": "2026-10-09T06:47:10Z",
  "updated_at": "2026-10-09T06:47:22Z",
  "activated_at": "2026-10-09T06:47:10Z",
  "enable_email_notifications": true,
  "state": "user",
  "public_facing": false,
  "title": null,
  "trusted": true,
  "company_id": 2,
  "external_id": "lucas@northwind.example.com",
  "discussions_count": 3,
  "comments_count": 4,
  "href": "https://api.tenderapp.com/yoursite/users/14",
  "discussions_href": "https://api.tenderapp.com/yoursite/users/14/discussions{?page,user_email}"
}

A user's id is the number at the end of their href.

Your own user

/profile gives the user the token belongs to, in the same shape.

curl -H "Accept: application/vnd.tender-v1+json" \
     -H "Authorization: Bearer $TENDER_TOKEN" \
     https://api.tenderapp.com/yoursite/profile

User fields

Field	What it is
name	The user's name.
email	Their main email address.
title	Their job title, if they gave one.
state	user (a customer), support (support staff), unregistered (has written in by email but never signed up), disabled or spammer.
activated_at	When they confirmed their email address. null until they do.
trusted	Whether Tender skips the spam check on their posts (see below). Read only.
external_id	The id your single sign-on knows them by. It's their email address unless you set something else.
company_id	The company they belong to, or null.
extras	Your own key/value details about the user (see below). Only there when set.
public_facing	For support staff: whether they're shown on your site.
enable_email_notifications	Whether they get email notifications at all. They change it in their own settings; it can't be set through the API.
discussions_count, comments_count	How many discussions they started and comments they wrote.
avatar_url, avatar_large_url	Their picture, 32 and 48 pixels wide.
created_at, updated_at	When the user was added and last changed.
href	This user in the API.
discussions_href	Their discussions (see below).

Trusted users. Tender checks new posts for spam unless the author is trusted. Support staff and people who wrote in by email are always trusted. A customer becomes trusted when one of your support staff replies publicly to a discussion of theirs that was waiting for an answer, or when your single sign-on marks them trusted. Marking someone a spammer takes it away.

Extras. Anything you want your team to know about a customer, such as their plan or account number. Support staff see the extras next to the user's discussions. An avatar_url in the extras replaces the user's picture.

Create a user

POST the new user's details. email, password and password_confirmation are required (the password is 6 to 40 characters); name, title, external_id and company_id are optional. Without a name, Tender uses the first part of the email address.

curl -H "Accept: application/vnd.tender-v1+json" \
     -H "Authorization: Bearer $TENDER_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{"name":"Grace Liu","email":"grace@harborpine.example.com",
          "password":"correct-horse-42","password_confirmation":"correct-horse-42",
          "title":"Operations Lead","external_id":"hp-2041","company_id":4,
          "skip_activation":true}' \
     https://api.tenderapp.com/yoursite/users

HTTP/1.1 201 Created
Location: http://api.tenderapp.com/yoursite/users/20

{
  "name": "Grace Liu",
  "email": "grace@harborpine.example.com",
  "activated_at": "2026-10-09T07:16:24Z",
  "state": "user",
  "title": "Operations Lead",
  "trusted": false,
  "company_id": 4,
  "external_id": "hp-2041",
  "href": "https://api.tenderapp.com/yoursite/users/20",
  "discussions_href": "https://api.tenderapp.com/yoursite/users/20/discussions{?page,user_email}"
}

Activation. Normally a new user gets an email asking them to confirm their address, and stays unactivated (activated_at is null) until they click the link. Send "skip_activation": true when you already know the address is theirs: Tender activates the user at once and sends no email. Leave it out when you want the email to go: any value other than false or null, even "0", counts as yes.

company_id is used only when your plan includes companies.

If the email address already belongs to someone on your site, you get a 422:

{
  "base": ["Email is already taken by another user."],
  "email": ["is already taken by another user"]
}

One exception: if the address belongs to an existing user and the password you send is theirs, Tender doesn't create anyone and answers 200 with that user.

Update a user

PUT only the fields you want to change.

curl -X PUT \
     -H "Accept: application/vnd.tender-v1+json" \
     -H "Authorization: Bearer $TENDER_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{"title":"Head of Operations","extras":{"plan":"Team","seats":"12"}}' \
     https://api.tenderapp.com/yoursite/users/20

{
  "name": "Grace Liu",
  "title": "Head of Operations",
  "company_id": 4,
  "external_id": "hp-2041",
  "extras": {
    "plan": "Team",
    "seats": "12"
  },
  "href": "https://api.tenderapp.com/yoursite/users/20"
}

You can change:

• name, title, email, external_id
• password with password_confirmation
• company_id (when your plan includes companies; null takes them out of their company)
• extras: the whole set at once. What you send replaces the user's extras, so include the keys you want to keep.
• beta and important (true or false): access to beta and important categories and knowledge base sections. These two aren't among the fields the API shows; ?filter=beta and ?filter=important list who has them.
• public_facing
• state, for example support to make someone support staff or disabled to disable them. Only staff who can change your site's settings can change it.

Some details are protected. The site owner's state can't be changed, and only the owner can change their own email and password. Other support staff's email and password can only be changed by staff who can change your site's settings.

To update your own user, PUT to /profile instead.

Category notifications

People can ask to be emailed about every new discussion in a category. Set it for a user with cat, a map of category ids to 1 (email them) or 0 (don't):

curl -X PUT \
     -H "Accept: application/vnd.tender-v1+json" \
     -H "Authorization: Bearer $TENDER_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{"cat":{"9":"1","10":"0"}}' \
     https://api.tenderapp.com/yoursite/users/20/notifications

The answer is the user. Categories you leave out keep their setting, and categories the user can't see are ignored. Category ids are in Categories.

A user's discussions

discussions_href lists the discussions a user started, newest activity first:

curl -H "Accept: application/vnd.tender-v1+json" \
     -H "Authorization: Bearer $TENDER_TOKEN" \
     https://api.tenderapp.com/yoursite/users/14/discussions

Add a state to the path to narrow it, such as /users/14/discussions/open (or new, assigned, resolved, pending, deleted, spam). The discussions look as they do in Discussions.