Skip to main content

Sub-users

Sub-users are API users. While you can use the super-user for single-user projects, it is recommended to create sub-users for multi-user projects and assign privileges per table.

Create a new sub-user​

Create a new sub-user
POST https://api.centia.io/api/v4/users HTTP/1.1
Content-Type: application/json
Authorization: Bearer abc123

{
    "name": "alx",
    "email": "alx@gunsnroses.com",
    "password": "Paradise_City!%Rck1987"
}
Create multiple sub-users
POST https://api.centia.io/api/v4/users HTTP/1.1
Content-Type: application/json
Authorization: Bearer abc123

[
    {
        "name": "alx",
        "email": "alx@gunsnroses.com",
        "password": "Paradise_City!%Rck1987"
    },
    {
        "name": "slash",
        "email": "slash@gunsnroses.com",
        "password": "November_Rain!%Pno1991"
    },
    {
        "name": "izzy",
        "email": "izzy@gunsnroses.com",
        "password": "KnockinOn_HeavensDoor!%GnR1990"
    },
    {
        "name": "duff",
        "email": "duff@gunsnroses.com",
        "password": "Welcome2_Jungle!%AxL1987"
    },
    {
        "name": "steven",
        "email": "steven@gunsnroses.com",
        "password": "SweetChild_oMine!%Gtr1987"
    }
]

Get sub-users​

Get specific sub-users
GET https://api.centia.io/api/v4/users/alx,slash HTTP/1.1
Accept: application/json; charset=utf-8
Authorization: Bearer abc123
Get all sub-users
GET https://api.centia.io/api/v4/users HTTP/1.1
Accept: application/json; charset=utf-8
Authorization: Bearer abc123

Update sub-users​

It is not possible to update all sub-users in a single operation. You must specify the sub-users explicitly.

Update specific sub-users
PATCH https://api.centia.io/api/v4/users/alx,slash HTTP/1.1
Content-Type: application/json
Authorization: Bearer abc123

{
    "user_group": "[\"gunsnroses\"]"
}

Delete sub-users​

It is not possible to delete all sub-users in a single operation. You must specify the sub-users explicitly.

Delete specific sub-users
DELETE https://api.centia.io/api/v4/users/izzy,steven HTTP/1.1
Accept: application/json; charset=utf-8
Authorization: Bearer abc123

Groups and inheritance​

Sub-users can be organized in groups, and privileges granted to a group are inherited by its members. A group is simply a sub-user itself: create a sub-user to act as the group (e.g. gunsnroses) and add other sub-users to it by setting their user_group property.

The user_group property holds a JSON array of group names, encoded as a string. It can be set when creating a sub-user or later with a PATCH:

Add sub-users to a group
PATCH https://api.centia.io/api/v4/users/alx,slash HTTP/1.1
Content-Type: application/json
Authorization: Bearer abc123

{
    "user_group": "[\"gunsnroses\"]"
}
Membership of multiple groups
PATCH https://api.centia.io/api/v4/users/slash HTTP/1.1
Content-Type: application/json
Authorization: Bearer abc123

{
    "user_group": "[\"gunsnroses\", \"velvetrevolver\"]"
}

A sub-user can be a member of multiple groups, and a group can itself be a member of other groups, so inheritance is transitive across multiple levels. Cyclic and diamond-shaped memberships are handled safely.

How privileges are resolved​

The effective privilege of a sub-user on a table is the highest privilege found among:

  • the sub-user's own privilege on the table, and
  • the privileges of every group in the sub-user's full inheritance chain.

Privileges rank none < read < write. If alx has no explicit privilege on rockhall.inductees but the group gunsnroses has write, then alx effectively has write on the table.

Schema ownership is inherited the same way: a sub-user owns a schema when the sub-user — or any group in its inheritance chain — has the same name as the schema. Since every sub-user gets a schema named after itself, adding members to the group gunsnroses also gives them full access to the gunsnroses schema.

note

Inheritance applies everywhere privileges are enforced: SQL and the HTTP API as well as the OGC services (WMS/WFS). The super-user (the database owner) always has full access and is not affected by groups.

Signup (Browser – Create a new user)​

Centia.io supports signup via the browser. From your app, you can redirect the user to the signup page:

https://api.centia.io/signup?client_id=abc123&parentdb=mydb&redirect_uri=https://myapp.com/login

Parameters:

  • client_id: OAuth client id configured in Centia.io
  • parentdb: The parent/tenant database under which the new user should be created
  • redirect_uri: URL in your app to return to after sign‑up

Using the SDK​

The SDK has a SignUp helper that redirects the user to the signup page:

import { SignUp } from "@centia-io/sdk";

const signUp = new SignUp({
  host: "https://api.centia.io",
  clientId: "your-client-id",
  parentDb: "your-parent-database",
  redirectUri: "https://myapp.com/login"
});

// Start sign-up when the user clicks "Create account"
function onSignUpClick() {
  signUp.signUp(); // Redirects to the Centia.io sign-up page
}
note
  • After the user completes sign-up and is redirected back to your app, start your normal sign-in flow (for example, CodeFlow). A session is already started, so the user is typically signed in automatically.
  • Client property allow_signup must be set to true for the used OAuth client.
  • Client property social_signup must be set to true for users to sign up with social login.