User Administration

To add, edit, or delete users in your organization on ThreatStream.

Request

/api/v1/orgadmin/

Create a new user POST /api/v1/orgadmin/
Get a list of users GET /api/v1/orgadmin/
Get a specific user

GET /api/v1/orgadmin/<user_id>
Modify an existing user PATCH /api/v1/orgadmin/<user_id>
Unlock the account of an existing user PATCH /api/v1/orgadmin/<user_id>/unlock
Delete a user DELETE /api/v1/orgadmin/<user_id>

Attributes: See the Attributes table below

Attributes

Attribute Type Description
can_approve_intel boolean Whether the user can approve imported intelligence.
can_import_to_taxii_inbox boolean Whether the user can push data from TAXII clients to your ThreatStream TAXII server.
can_see_api_key boolean Whether the user can access their dedicated ThreatStream API key on the My Profile tab within ThreatStream settings.
can_share_intelligence boolean Whether the user can create intelligence shared with the Anomali Community. This includes importing observables, creating Sandbox Reports, as well as modifying tags and commenting on observables and Sandbox Reports shared with the Anomali Community.
can_use_chat boolean

Whether the user can use ThreatStream Chat.

Note: To grant users this privilege, ThreatStream Chat must be enabled for your organization from the Organization within settings.
email string Email address of the user you want to add to your organization.
is_org_admin boolean Whether the user is an Org Admin.
is_readonly boolean

Whether the user should be restricted to Read Only status.

Note: You cannot set is_readonly to true when any of the following attributes are also set to true: can_share_intelligence, can_import_to_taxii_inbox, can_approve_intel, or is_org_admin.
is_tfa_exempt boolean Whether the user is excluded from having to use multi-factor authentication.
must_change_password boolean

Force existing users to change their password the next time they login.
user_id string

ID of the user you want to edit or delete.

Execute a GET request to retrieve IDs of users in your organization.

Response

The response contains all request attributes (except must_change_password) in addition to the following attributes.

Attribute Description
avatar_s3_url URL for the avatar image associated with the user.

date_joined

 Timestamp when the user was added to ThreatStream.
date_password_changed Timestamp when the user last changed their password.
is_active Whether the user is active.
is_locked Whether the user is currently locked.

last_access_ts

Timestamp when the user last accessed ThreatStream.
last_login Timestamp when the user was last authenticated to ThreatStream.
must_change_password Whether the user will be forced to change their password the next time they login.
name Name entered by the user on the My Profile tab within ThreatStream Settings.
next_password_change_ts Future timestamp when the user will be forced to change their password.
nickname Nickname entered by the user on the Profile screen, accessible through the ThreatStream menu.
resource_uri Resource URI of the user.
user_id

ID of the user.

Examples

Note: The user whose username and API key is used in requests must have Organization Administrator privileges.

  1. To get a list of users in your organization:

    Copy 
    curl 'https://api.threatstream.com/api/v1/orgadmin/' -H 'Authorization: apikey <username>:<api_key>'

  2. To create a non-Read Only user with all available privileges:

    Copy 
    curl --request POST --data '{"email": "newuser@company.com","is_org_admin": true,"can_approve_intel": true,"can_share_intelligence": true,"can_see_api_key": true,"can_import_to_taxii_inbox": true}' 'https://api.threatstream.com/api/v1/orgadmin/' -H 'Authorization: apikey <username>:<api_key>' -H 'Content-Type:application/json' -v

  3. To give Org Admin privileges to the existing user whose ID is 145:

    Copy 
    curl --request PATCH --data '{"is_org_admin": true}' 'https://api.threatstream.com/api/v1/orgadmin/145/' -H 'Authorization: apikey <username>:<api_key>' -H 'Content-Type:application/json' -v

  4. To give Read Only privileges to the existing user whose ID is 123:

    Copy 
    curl --request PATCH --data '{"is_readonly": true}' 'https://api.threatstream.com/api/v1/orgadmin/123/' -H 'Authorization: apikey <username>:<api_key>' -H 'Content-Type:application/json' -v

    If this user had any of the following privileges, they would be automatically removed: can_share_intelligence, can_import_to_taxii_inbox, can_approve_intel, or is_org_admin.

  5. To delete the user whose ID is 348:

    Copy 
    curl --request DELETE 'https://api.threatstream.com/api/v1/orgadmin/348/' -H 'Authorization: apikey <username>:<api_key>' -v

  6. To force the user whose ID is 145 to change their password:

    Copy 
    curl --request PATCH --data '{"must_change_password": true}' 'https://api.threatstream.com/api/v1/orgadmin/145/' -H 'Authorization: apikey <username>:<api_key>' -H 'Content-Type:application/json' -v

  7. To unlock the user whose account has been locked due to successive failed login attempts and whose ID is 123:

    Copy 
    curl --request PATCH  'https://api.threatstream.com/api/v1/orgadmin/123/unlock/' -H 'Authorization: apikey <username>:<api_key>' -v