Admin: user management

All endpoints on this page require both a valid Bearer token and the admin role. Requests from non-admin accounts return 403 Forbidden.

These endpoints let administrators inspect and manage user accounts across the platform. They are protected by two middleware layers: authenticate (validates the JWT) and isAdmin (checks role === "admin").

POST /api/auth/admin-login Administrators authenticate through a dedicated login endpoint. The returned token carries the admin role and is required to call any of the endpoints below.

string

required

Administrator email address.

password

string

required

Administrator password.

Example

curl --request POST \
  --url https://api.hayon.app/api/auth/admin-login \
  --header 'Content-Type: application/json' \
  --data '{
    "email": "[email protected]",
    "password": "supersecretpassword"
  }'

Get all users

GET /api/admin/get-all-users Returns a list of all registered users. Each record includes the user’s profile, subscription plan, account status, and usage data.

Authorization

string

required

Admin Bearer token. Format: Bearer <token>.

Response

message

string

Status message.

data

object[]

Array of user objects.

Show user object properties

_id

string

MongoDB document ID for the user.

string

User’s email address.

name

string

User’s display name.

role

string

Account role. One of user or admin.

isDisabled

boolean

true if the account has been deactivated by an admin.

subscription

object

Show subscription properties

plan

string

Current plan: free or pro.

status

string

Subscription status: active, cancelled, or pastDue.

currentPeriodEnd

string

ISO 8601 datetime. When the current billing period ends.

cancelAtPeriodEnd

boolean

Whether the subscription is scheduled to cancel.

usage

object

Show usage properties

captionGenerations

number

AI caption generations used this period.

postsCreated

number

Posts created this period.

createdAt

string

ISO 8601 datetime. When the account was created.

ISO 8601 datetime. Most recent login timestamp.

Example

curl --request GET \
  --url https://api.hayon.app/api/admin/get-all-users \
  --header 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'

Response

{
  "message": "Users retrieved successfully",
  "data": [
    {
      "_id": "6643f1a2b4e3c21d8a9f0012",
      "email": "[email protected]",
      "name": "Alice Chen",
      "role": "user",
      "isDisabled": false,
      "subscription": {
        "plan": "pro",
        "status": "active",
        "currentPeriodEnd": "2025-04-01T00:00:00.000Z",
        "cancelAtPeriodEnd": false
      },
      "usage": {
        "captionGenerations": 34,
        "postsCreated": 21
      },
      "createdAt": "2024-11-01T09:30:00.000Z",
      "lastLogin": "2025-03-20T14:22:00.000Z"
    }
  ]
}

Update user plan

PATCH /api/admin/update-user-plan/:id Overrides the plan for a specific user. Use this to manually upgrade or downgrade an account outside of the normal Stripe checkout flow.

Changing a user’s plan via this endpoint does not create or modify any Stripe subscription. It only updates the database record. Use with care to avoid billing and access discrepancies.

Authorization

string

required

Admin Bearer token.

string

required

The MongoDB _id of the user to update.

plan

string

required

The new plan. Must be exactly free or pro.

Response

message

string

Confirmation message.

data

object

Show properties

userId

string

The ID of the updated user.

plan

string

The newly applied plan.

Example

curl --request PATCH \
  --url 'https://api.hayon.app/api/admin/update-user-plan/6643f1a2b4e3c21d8a9f0012?plan=pro' \
  --header 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'

Response

{
  "message": "User plan updated successfully",
  "data": {
    "userId": "6643f1a2b4e3c21d8a9f0012",
    "plan": "pro"
  }
}

Update user activity

PATCH /api/admin/update-user-activity/:id Activates or deactivates a user account. Deactivated accounts (isDisabled: true) cannot log in or access the platform.

Authorization

string

required

Admin Bearer token.

string

required

The MongoDB _id of the user to update.

activity

boolean

required

true to activate the account, false to deactivate it.

Response

message

string

Confirmation message.

data

object

The full updated user document.

Example

curl --request PATCH \
  --url https://api.hayon.app/api/admin/update-user-activity/6643f1a2b4e3c21d8a9f0012 \
  --header 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...' \
  --header 'Content-Type: application/json' \
  --data '{"activity": false}'

Response

{
  "message": "User activity status updated successfully",
  "data": {
    "_id": "6643f1a2b4e3c21d8a9f0012",
    "email": "[email protected]",
    "name": "Alice Chen",
    "isDisabled": false
  }
}

Overview

Auth

Posts

Analytics

Platforms

Payments

Profile

Admin

Admin: user management

Example

Get all users

Response

Example

Update user plan

Response

Example

Update user activity

Response

Example

Build docs developers (and LLMs) love

Overview

Auth

Posts

Analytics

Platforms

Payments

Profile

Admin

​Admin login

​Example

​Get all users

​Response

​Example

​Update user plan

​Response

​Example

​Update user activity

​Response

​Example

Build docs developers (and LLMs) love

Admin login

Example

Get all users

Response

Example

Update user plan

Response

Example

Update user activity

Response

Example