# Admin: Set User Details
## Endpoint
`/api/admin/users/set`
## Method
GET
## Description
Allows changing user account profile details.
## Authentication
Required. Token must be provided via the `token` parameter.
## Permissions
Administration: Modify
## Parameters
| `token` | string | Yes | No | The session token generated by the `login` or the `createToken` call. |
| `user` | string | Yes | No | The username for the user account to update. |
| `displayName` | string | No | No | The display name for the user account. |
| `newUser` | string | No | No | A new username for renaming the user account. |
| `totpEnabled` | boolean | No | No | Set to `false` to disable 2FA for the user account. Cannot be set to `true` via this endpoint. |
| `disabled` | boolean | No | No | Set `true` to disable the user account and delete all its active sessions. |
| `sessionTimeoutSeconds` | integer | No | No | A session timeout value in seconds for the user account. |
| `newPass` | string | No | No | A new password to reset the user account password. |
| `iterations` | integer | No | Yes | The number of iterations for PBKDF2 SHA256 password hashing. Only used with the `newPass` option. |
| `memberOfGroups` | string | No | No | A comma-separated list of group names that the user must be set as a member of. |
## Response Fields
| `displayName` | string | The display name of the user. |
| `username` | string | The (possibly updated) username. |
| `totpEnabled` | boolean | Whether 2FA is enabled. |
| `disabled` | boolean | Whether the account is disabled. |
| `previousSessionLoggedOn` | string (datetime) | ISO 8601 timestamp of previous session login. |
| `previousSessionRemoteAddress` | string | IP address from previous session login. |
| `recentSessionLoggedOn` | string (datetime) | ISO 8601 timestamp of most recent session login. |
| `recentSessionRemoteAddress` | string | IP address from most recent session login. |
| `sessionTimeoutSeconds` | integer | The session timeout value in seconds. |
| `memberOfGroups` | array of strings | List of group names the user is a member of. |
| `sessions` | array | List of active session objects for this user. |
| `sessions[].username` | string | The username associated with the session. |
| `sessions[].isCurrentSession` | boolean | Whether this is the session making the current request. |
| `sessions[].partialToken` | string | Partial token identifying the session. |
| `sessions[].type` | string | Session type: `Standard` or `ApiToken`. |
| `sessions[].tokenName` | string or null | Name of the API token, or null for standard sessions. |
| `sessions[].lastSeen` | string (datetime) | ISO 8601 timestamp of last activity. |
| `sessions[].lastSeenRemoteAddress` | string | IP address of last activity. |
| `sessions[].lastSeenUserAgent` | string | User-Agent string of last activity. |
## Conditional Logic Notes
- The `iterations` parameter is only meaningful when used alongside `newPass`. It has no effect without `newPass`.
- The `totpEnabled` parameter can only be set to `false` (to disable 2FA). It cannot be used to enable 2FA; TOTP must be set up through the user's own profile flow.
- Setting `disabled` to `true` will also delete all active sessions for that user.
- The `memberOfGroups` parameter replaces the full group membership; it is not additive. Omitting it leaves membership unchanged.
## Edge Cases
- Renaming a user via `newUser` changes the username across the system. Existing sessions may be affected.
- Disabling a user deletes all their active sessions immediately, effectively forcing a logout.
- Setting `memberOfGroups` to an empty string would remove the user from all groups.