/api/v1/group

Manage user groups. A group bundles a set of users together so they can be addressed by the ACL system. Each group has an owner (_owner), an optional set of ACL items (_acl), system rights (_system_rights), auth-method group mappings (_auth_method_group_maps) and IP/subnet filters (_ip_subnet_filter). Groups are stored in the group table; create / update / delete take effect immediately on the request transaction (there is no working-copy / commit step).

Creating, updating (POST / PUT) and deleting (DELETE) groups require the system.group (or system.root) system right. Listing and reading groups (GET) require no system right — the results are filtered to the groups the current session may read (bag_read); a system.root user sees all groups.

Differs from easydb 5: easydb 5 requires an authenticated session with the system.group right to read groups. fylr requires no system right on GET; an unauthenticated list request returns an empty array rather than an error.

GET /group — List all groups visible to the current session.

List all groups visible to the current session.

get

Returns the groups the current session may read (bag_read); a system.root user sees all groups. Groups the session may not read are silently omitted — no 403 is raised, and an unauthenticated request simply yields an empty list, not a 401. The result is paged with limit / offset and can be narrowed to specific group types.

Authorizations

BearerAuthAccessTokenQueryFylrAuthHeader

AuthorizationstringRequired

Access token in the Authorization header: Authorization: Bearer <token>.

Query parameters

limitinteger · int64Optional

Maximum number of groups to return. Defaults to 1000.

Default: 1000

offsetinteger · int64Optional

Number of groups to skip before collecting the result page. Defaults to 0.

Default: 0

typestringOptional

Comma-separated list of group types to return. When set, only groups whose type is in the list are returned. Valid types: easydb, system. Example: type=easydb,system.

Responses

200

Array of all groups visible to the current session.

application/json

A user group. Bundles a set of users together so the ACL system can address them collectively.

_basetypestring · enumRequired

Fixed marker identifying this object as a group.

Possible values:

_ip_subnet_filterstring[]Optional

CIDR / subnet entries. If set, members of this group can only sign in from a matching network — unless _ip_subnet_filter_exclude is true, in which case the matching networks are denied.

_ip_subnet_filter_excludebooleanOptional

Invert the meaning of _ip_subnet_filter.

_created_atstring · date-timeOptional

UTC time the group was created.

_updated_atstring · date-timeOptional

UTC time the group was last updated.

200

Array of all groups visible to the current session.

[
  {
    "_basetype": "group",
    "group": {
      "_id": 1,
      "_version": 1,
      "reference": "text",
      "name": "text",
      "comment": "text",
      "category_a": "text",
      "category_b": "text",
      "category_c": "text",
      "displayname": {
        "de-DE": "Deutscher text",
        "en-US": "English text"
      },
      "frontend_prefs": {
        "ANY_ADDITIONAL_PROPERTY": "anything"
      },
      "type": "easydb",
      "lookup:_id": {
        "reference": "text"
      }
    },
    "_generated_rights": {
      "ANY_ADDITIONAL_PROPERTY": {
        "_grantable": true,
        "allow_update_and_remove": true,
        "classes": [
          "text"
        ],
        "extensions": [
          "text"
        ],
        "versions": [
          "text"
        ],
        "limit": 1,
        "mask_ids": {
          "ANY_ADDITIONAL_PROPERTY": []
        },
        "column_ids": [
          1
        ],
        "objecttype_ids": [
          1
        ],
        "pool_ids": [
          1
        ]
      }
    },
    "_acl": [
      {
        "_id": 1,
        "who": {
          "_basetype": "user",
          "_owner": true,
          "_pool_contact": true,
          "user": {
            "_id": 1,
            "lookup:_id": {
              "reference": "text"
            },
            "_generated_displayname": "text",
            "ANY_ADDITIONAL_PROPERTY": "anything"
          },
          "group": {
            "_id": 1,
            "lookup:_id": {
              "reference": "text"
            },
            "_generated_displayname": "text"
          }
        },
        "sticky": true,
        "active": true,
        "_right_preset": 1,
        "when": {
          "from": "2026-06-10T15:54:14.033Z",
          "to": "2026-06-10T15:54:14.033Z"
        },
        "rights": {
          "ANY_ADDITIONAL_PROPERTY": {
            "_grantable": true,
            "allow_update_and_remove": true,
            "classes": [
              "text"
            ],
            "extensions": [
              "text"
            ],
            "versions": [
              "text"
            ],
            "limit": 1,
            "mask_ids": {
              "ANY_ADDITIONAL_PROPERTY": []
            },
            "column_ids": [
              1
            ],
            "objecttype_ids": [
              1
            ],
            "pool_ids": [
              1
            ]
          }
        },
        "tagfilter": {
          "all": [
            1
          ],
          "any": [
            1
          ],
          "not": [
            1
          ],
          "changed": [
            1
          ]
        },
        "send_email_notification": {
          "text": "text"
        }
      }
    ],
    "_system_rights": {
      "system.user": {
        "read": true
      },
      "system.api.event": {
        "get": true
      },
      "system.api.publish": {
        "post": true,
        "get": true
      }
    },
    "_pseudonymization": {
      "user": {
        "login": "text",
        "first_name": "text",
        "last_name": "text",
        "displayname": "text",
        "additional_info": "text",
        "_emails": "text"
      }
    },
    "_auth_method_group_maps": {
      "sso": [
        {
          "method": "text",
          "value": "text"
        }
      ],
      "ldap": [
        {
          "method": "text",
          "value": "text"
        }
      ],
      "system": [
        {
          "method": "text",
          "value": "text"
        }
      ]
    },
    "_ip_subnet_filter": [
      "text"
    ],
    "_ip_subnet_filter_exclude": true,
    "_owner": {
      "_basetype": "user",
      "_owner": true,
      "_pool_contact": true,
      "user": {
        "_id": 1,
        "lookup:_id": {
          "reference": "text"
        },
        "_generated_displayname": "text",
        "ANY_ADDITIONAL_PROPERTY": "anything"
      },
      "group": {
        "_id": 1,
        "lookup:_id": {
          "reference": "text"
        },
        "_generated_displayname": "text"
      }
    },
    "_created_at": "2026-06-10T15:54:14.033Z",
    "_updated_at": "2026-06-10T15:54:14.033Z",
    "_automatic_auth": {
      "type": "text",
      "timestamp": "2026-06-10T15:54:14.033Z"
    }
  }
]

POST /group — Create or update one or more groups.

Create or update one or more groups.

post

The payload is an array of group objects. Whether a group is created or updated is decided by group._version: a group sent with _version: 1 is created; a group sent with a higher _version is updated and its group._version must equal the stored version + 1, otherwise the request fails with a 400 code: VersionMismatch. An update also requires the stored group._id (or a lookup:_id object that resolves one). The response carries the saved groups with their _id / _version populated.

Creating a group of type: system is rejected with a 400 code: GroupTypeNotAllowed; changing a stored group's type is rejected with a 400 code: GroupTypeChangeNotAllowed.

PUT /group is an exact alias — same handler, same semantics.

Differs from easydb 5: in easydb 5 the HTTP method selects the operation (PUT creates, POST updates). In fylr both methods run the same handler and the operation is chosen per group by group._version, so a single array may mix creates and updates.

Authorizations

BearerAuthAccessTokenQueryFylrAuthHeader

AuthorizationstringRequired

Access token in the Authorization header: Authorization: Bearer <token>.

Bodyobject[]

application/json

A user group. Bundles a set of users together so the ACL system can address them collectively.

_basetypestring · enumRequired

Fixed marker identifying this object as a group.

Possible values:

_ip_subnet_filterstring[]Optional

CIDR / subnet entries. If set, members of this group can only sign in from a matching network — unless _ip_subnet_filter_exclude is true, in which case the matching networks are denied.

_ip_subnet_filter_excludebooleanOptional

Invert the meaning of _ip_subnet_filter.

_created_atstring · date-timeOptional

UTC time the group was created.

_updated_atstring · date-timeOptional

UTC time the group was last updated.

Responses

200

The groups were saved. The response carries the saved groups with their _id / _version populated.

application/json

A user group. Bundles a set of users together so the ACL system can address them collectively.

_basetypestring · enumRequired

Fixed marker identifying this object as a group.

Possible values:

_ip_subnet_filterstring[]Optional

CIDR / subnet entries. If set, members of this group can only sign in from a matching network — unless _ip_subnet_filter_exclude is true, in which case the matching networks are denied.

_ip_subnet_filter_excludebooleanOptional

Invert the meaning of _ip_subnet_filter.

_created_atstring · date-timeOptional

UTC time the group was created.

_updated_atstring · date-timeOptional

UTC time the group was last updated.

400

The request could not be processed. Common causes and their code: a group._version that is not stored version + 1 on update (VersionMismatch); creating a type: system group (GroupTypeNotAllowed) or changing a stored group's type (GroupTypeChangeNotAllowed); deleting a type: system group (DeleteSystemGroup); the instance being in read-only mode (ReadOnlyMode). A malformed payload or a group id in the URL that matches no stored group surfaces as code: ServerGeneric (there is no dedicated 404 for a missing group).

application/json

401

No authenticated user. The request must carry a valid access token.

application/json

403

The authenticated user lacks a required right. Create / update (POST / PUT) and delete (DELETE) first require the system.group (or system.root) system right; missing it yields code: SystemRightRequired with parameters.rights listing the accepted rights. A non-root user is then checked further: creating needs system.group[create] (and [create_acl] / [create_system_rights] when _acl / _system_rights are sent), editing an existing group's _acl / _system_rights needs system.group[edit_acl] / [edit_system_rights] — these also surface as SystemRightRequired. Per-group ACL failures use code: RightRequired: bag_read on read, bag_write on update, delete on delete; changing a group's owner additionally requires system.root.

application/json

[
  {
    "_basetype": "group",
    "group": {
      "_id": 1,
      "_version": 1,
      "reference": "text",
      "name": "text",
      "comment": "text",
      "category_a": "text",
      "category_b": "text",
      "category_c": "text",
      "displayname": {
        "de-DE": "Deutscher text",
        "en-US": "English text"
      },
      "frontend_prefs": {
        "ANY_ADDITIONAL_PROPERTY": "anything"
      },
      "type": "easydb",
      "lookup:_id": {
        "reference": "text"
      }
    },
    "_generated_rights": {
      "ANY_ADDITIONAL_PROPERTY": {
        "_grantable": true,
        "allow_update_and_remove": true,
        "classes": [
          "text"
        ],
        "extensions": [
          "text"
        ],
        "versions": [
          "text"
        ],
        "limit": 1,
        "mask_ids": {
          "ANY_ADDITIONAL_PROPERTY": []
        },
        "column_ids": [
          1
        ],
        "objecttype_ids": [
          1
        ],
        "pool_ids": [
          1
        ]
      }
    },
    "_acl": [
      {
        "_id": 1,
        "who": {
          "_basetype": "user",
          "_owner": true,
          "_pool_contact": true,
          "user": {
            "_id": 1,
            "lookup:_id": {
              "reference": "text"
            },
            "_generated_displayname": "text",
            "ANY_ADDITIONAL_PROPERTY": "anything"
          },
          "group": {
            "_id": 1,
            "lookup:_id": {
              "reference": "text"
            },
            "_generated_displayname": "text"
          }
        },
        "sticky": true,
        "active": true,
        "_right_preset": 1,
        "when": {
          "from": "2026-06-10T15:54:14.033Z",
          "to": "2026-06-10T15:54:14.033Z"
        },
        "rights": {
          "ANY_ADDITIONAL_PROPERTY": {
            "_grantable": true,
            "allow_update_and_remove": true,
            "classes": [
              "text"
            ],
            "extensions": [
              "text"
            ],
            "versions": [
              "text"
            ],
            "limit": 1,
            "mask_ids": {
              "ANY_ADDITIONAL_PROPERTY": []
            },
            "column_ids": [
              1
            ],
            "objecttype_ids": [
              1
            ],
            "pool_ids": [
              1
            ]
          }
        },
        "tagfilter": {
          "all": [
            1
          ],
          "any": [
            1
          ],
          "not": [
            1
          ],
          "changed": [
            1
          ]
        },
        "send_email_notification": {
          "text": "text"
        }
      }
    ],
    "_system_rights": {
      "system.user": {
        "read": true
      },
      "system.api.event": {
        "get": true
      },
      "system.api.publish": {
        "post": true,
        "get": true
      }
    },
    "_pseudonymization": {
      "user": {
        "login": "text",
        "first_name": "text",
        "last_name": "text",
        "displayname": "text",
        "additional_info": "text",
        "_emails": "text"
      }
    },
    "_auth_method_group_maps": {
      "sso": [
        {
          "method": "text",
          "value": "text"
        }
      ],
      "ldap": [
        {
          "method": "text",
          "value": "text"
        }
      ],
      "system": [
        {
          "method": "text",
          "value": "text"
        }
      ]
    },
    "_ip_subnet_filter": [
      "text"
    ],
    "_ip_subnet_filter_exclude": true,
    "_owner": {
      "_basetype": "user",
      "_owner": true,
      "_pool_contact": true,
      "user": {
        "_id": 1,
        "lookup:_id": {
          "reference": "text"
        },
        "_generated_displayname": "text",
        "ANY_ADDITIONAL_PROPERTY": "anything"
      },
      "group": {
        "_id": 1,
        "lookup:_id": {
          "reference": "text"
        },
        "_generated_displayname": "text"
      }
    },
    "_created_at": "2026-06-10T15:54:14.033Z",
    "_updated_at": "2026-06-10T15:54:14.033Z",
    "_automatic_auth": {
      "type": "text",
      "timestamp": "2026-06-10T15:54:14.033Z"
    }
  }
]

PUT /group — Create or update one or more groups (alias for POST).

Create or update one or more groups (alias for POST).

put

Identical semantics to POST /group.

Authorizations

BearerAuthAccessTokenQueryFylrAuthHeader

AuthorizationstringRequired

Access token in the Authorization header: Authorization: Bearer <token>.

Bodyobject[]

application/json

A user group. Bundles a set of users together so the ACL system can address them collectively.

_basetypestring · enumRequired

Fixed marker identifying this object as a group.

Possible values:

_ip_subnet_filterstring[]Optional

CIDR / subnet entries. If set, members of this group can only sign in from a matching network — unless _ip_subnet_filter_exclude is true, in which case the matching networks are denied.

_ip_subnet_filter_excludebooleanOptional

Invert the meaning of _ip_subnet_filter.

_created_atstring · date-timeOptional

UTC time the group was created.

_updated_atstring · date-timeOptional

UTC time the group was last updated.

Responses

200

The groups were saved. The response carries the saved groups with their _id / _version populated.

application/json

A user group. Bundles a set of users together so the ACL system can address them collectively.

_basetypestring · enumRequired

Fixed marker identifying this object as a group.

Possible values:

_ip_subnet_filterstring[]Optional

CIDR / subnet entries. If set, members of this group can only sign in from a matching network — unless _ip_subnet_filter_exclude is true, in which case the matching networks are denied.

_ip_subnet_filter_excludebooleanOptional

Invert the meaning of _ip_subnet_filter.

_created_atstring · date-timeOptional

UTC time the group was created.

_updated_atstring · date-timeOptional

UTC time the group was last updated.

400

The request could not be processed. Common causes and their code: a group._version that is not stored version + 1 on update (VersionMismatch); creating a type: system group (GroupTypeNotAllowed) or changing a stored group's type (GroupTypeChangeNotAllowed); deleting a type: system group (DeleteSystemGroup); the instance being in read-only mode (ReadOnlyMode). A malformed payload or a group id in the URL that matches no stored group surfaces as code: ServerGeneric (there is no dedicated 404 for a missing group).

application/json

401

No authenticated user. The request must carry a valid access token.

application/json

403

The authenticated user lacks a required right. Create / update (POST / PUT) and delete (DELETE) first require the system.group (or system.root) system right; missing it yields code: SystemRightRequired with parameters.rights listing the accepted rights. A non-root user is then checked further: creating needs system.group[create] (and [create_acl] / [create_system_rights] when _acl / _system_rights are sent), editing an existing group's _acl / _system_rights needs system.group[edit_acl] / [edit_system_rights] — these also surface as SystemRightRequired. Per-group ACL failures use code: RightRequired: bag_read on read, bag_write on update, delete on delete; changing a group's owner additionally requires system.root.

application/json

[
  {
    "_basetype": "group",
    "group": {
      "_id": 1,
      "_version": 1,
      "reference": "text",
      "name": "text",
      "comment": "text",
      "category_a": "text",
      "category_b": "text",
      "category_c": "text",
      "displayname": {
        "de-DE": "Deutscher text",
        "en-US": "English text"
      },
      "frontend_prefs": {
        "ANY_ADDITIONAL_PROPERTY": "anything"
      },
      "type": "easydb",
      "lookup:_id": {
        "reference": "text"
      }
    },
    "_generated_rights": {
      "ANY_ADDITIONAL_PROPERTY": {
        "_grantable": true,
        "allow_update_and_remove": true,
        "classes": [
          "text"
        ],
        "extensions": [
          "text"
        ],
        "versions": [
          "text"
        ],
        "limit": 1,
        "mask_ids": {
          "ANY_ADDITIONAL_PROPERTY": []
        },
        "column_ids": [
          1
        ],
        "objecttype_ids": [
          1
        ],
        "pool_ids": [
          1
        ]
      }
    },
    "_acl": [
      {
        "_id": 1,
        "who": {
          "_basetype": "user",
          "_owner": true,
          "_pool_contact": true,
          "user": {
            "_id": 1,
            "lookup:_id": {
              "reference": "text"
            },
            "_generated_displayname": "text",
            "ANY_ADDITIONAL_PROPERTY": "anything"
          },
          "group": {
            "_id": 1,
            "lookup:_id": {
              "reference": "text"
            },
            "_generated_displayname": "text"
          }
        },
        "sticky": true,
        "active": true,
        "_right_preset": 1,
        "when": {
          "from": "2026-06-10T15:54:14.033Z",
          "to": "2026-06-10T15:54:14.033Z"
        },
        "rights": {
          "ANY_ADDITIONAL_PROPERTY": {
            "_grantable": true,
            "allow_update_and_remove": true,
            "classes": [
              "text"
            ],
            "extensions": [
              "text"
            ],
            "versions": [
              "text"
            ],
            "limit": 1,
            "mask_ids": {
              "ANY_ADDITIONAL_PROPERTY": []
            },
            "column_ids": [
              1
            ],
            "objecttype_ids": [
              1
            ],
            "pool_ids": [
              1
            ]
          }
        },
        "tagfilter": {
          "all": [
            1
          ],
          "any": [
            1
          ],
          "not": [
            1
          ],
          "changed": [
            1
          ]
        },
        "send_email_notification": {
          "text": "text"
        }
      }
    ],
    "_system_rights": {
      "system.user": {
        "read": true
      },
      "system.api.event": {
        "get": true
      },
      "system.api.publish": {
        "post": true,
        "get": true
      }
    },
    "_pseudonymization": {
      "user": {
        "login": "text",
        "first_name": "text",
        "last_name": "text",
        "displayname": "text",
        "additional_info": "text",
        "_emails": "text"
      }
    },
    "_auth_method_group_maps": {
      "sso": [
        {
          "method": "text",
          "value": "text"
        }
      ],
      "ldap": [
        {
          "method": "text",
          "value": "text"
        }
      ],
      "system": [
        {
          "method": "text",
          "value": "text"
        }
      ]
    },
    "_ip_subnet_filter": [
      "text"
    ],
    "_ip_subnet_filter_exclude": true,
    "_owner": {
      "_basetype": "user",
      "_owner": true,
      "_pool_contact": true,
      "user": {
        "_id": 1,
        "lookup:_id": {
          "reference": "text"
        },
        "_generated_displayname": "text",
        "ANY_ADDITIONAL_PROPERTY": "anything"
      },
      "group": {
        "_id": 1,
        "lookup:_id": {
          "reference": "text"
        },
        "_generated_displayname": "text"
      }
    },
    "_created_at": "2026-06-10T15:54:14.033Z",
    "_updated_at": "2026-06-10T15:54:14.033Z",
    "_automatic_auth": {
      "type": "text",
      "timestamp": "2026-06-10T15:54:14.033Z"
    }
  }
]

GET /group/{id} — Retrieve a single group by id.

Retrieve a single group by id.

get

Authorizations

BearerAuthAccessTokenQueryFylrAuthHeader

AuthorizationstringRequired

Access token in the Authorization header: Authorization: Bearer <token>.

Path parameters

idinteger · int64 · min: 1Required

The group's _id.

Responses

200

The group, returned as a single-element array of group objects (the same shape as the create / delete responses).

application/json

A user group. Bundles a set of users together so the ACL system can address them collectively.

_basetypestring · enumRequired

Fixed marker identifying this object as a group.

Possible values:

_ip_subnet_filterstring[]Optional

CIDR / subnet entries. If set, members of this group can only sign in from a matching network — unless _ip_subnet_filter_exclude is true, in which case the matching networks are denied.

_ip_subnet_filter_excludebooleanOptional

Invert the meaning of _ip_subnet_filter.

_created_atstring · date-timeOptional

UTC time the group was created.

_updated_atstring · date-timeOptional

UTC time the group was last updated.

400

The request could not be processed. Common causes and their code: a group._version that is not stored version + 1 on update (VersionMismatch); creating a type: system group (GroupTypeNotAllowed) or changing a stored group's type (GroupTypeChangeNotAllowed); deleting a type: system group (DeleteSystemGroup); the instance being in read-only mode (ReadOnlyMode). A malformed payload or a group id in the URL that matches no stored group surfaces as code: ServerGeneric (there is no dedicated 404 for a missing group).

application/json

403

The authenticated user lacks a required right. Create / update (POST / PUT) and delete (DELETE) first require the system.group (or system.root) system right; missing it yields code: SystemRightRequired with parameters.rights listing the accepted rights. A non-root user is then checked further: creating needs system.group[create] (and [create_acl] / [create_system_rights] when _acl / _system_rights are sent), editing an existing group's _acl / _system_rights needs system.group[edit_acl] / [edit_system_rights] — these also surface as SystemRightRequired. Per-group ACL failures use code: RightRequired: bag_read on read, bag_write on update, delete on delete; changing a group's owner additionally requires system.root.

application/json

[
  {
    "_basetype": "group",
    "group": {
      "_id": 1,
      "_version": 1,
      "reference": "text",
      "name": "text",
      "comment": "text",
      "category_a": "text",
      "category_b": "text",
      "category_c": "text",
      "displayname": {
        "de-DE": "Deutscher text",
        "en-US": "English text"
      },
      "frontend_prefs": {
        "ANY_ADDITIONAL_PROPERTY": "anything"
      },
      "type": "easydb",
      "lookup:_id": {
        "reference": "text"
      }
    },
    "_generated_rights": {
      "ANY_ADDITIONAL_PROPERTY": {
        "_grantable": true,
        "allow_update_and_remove": true,
        "classes": [
          "text"
        ],
        "extensions": [
          "text"
        ],
        "versions": [
          "text"
        ],
        "limit": 1,
        "mask_ids": {
          "ANY_ADDITIONAL_PROPERTY": []
        },
        "column_ids": [
          1
        ],
        "objecttype_ids": [
          1
        ],
        "pool_ids": [
          1
        ]
      }
    },
    "_acl": [
      {
        "_id": 1,
        "who": {
          "_basetype": "user",
          "_owner": true,
          "_pool_contact": true,
          "user": {
            "_id": 1,
            "lookup:_id": {
              "reference": "text"
            },
            "_generated_displayname": "text",
            "ANY_ADDITIONAL_PROPERTY": "anything"
          },
          "group": {
            "_id": 1,
            "lookup:_id": {
              "reference": "text"
            },
            "_generated_displayname": "text"
          }
        },
        "sticky": true,
        "active": true,
        "_right_preset": 1,
        "when": {
          "from": "2026-06-10T15:54:14.033Z",
          "to": "2026-06-10T15:54:14.033Z"
        },
        "rights": {
          "ANY_ADDITIONAL_PROPERTY": {
            "_grantable": true,
            "allow_update_and_remove": true,
            "classes": [
              "text"
            ],
            "extensions": [
              "text"
            ],
            "versions": [
              "text"
            ],
            "limit": 1,
            "mask_ids": {
              "ANY_ADDITIONAL_PROPERTY": []
            },
            "column_ids": [
              1
            ],
            "objecttype_ids": [
              1
            ],
            "pool_ids": [
              1
            ]
          }
        },
        "tagfilter": {
          "all": [
            1
          ],
          "any": [
            1
          ],
          "not": [
            1
          ],
          "changed": [
            1
          ]
        },
        "send_email_notification": {
          "text": "text"
        }
      }
    ],
    "_system_rights": {
      "system.user": {
        "read": true
      },
      "system.api.event": {
        "get": true
      },
      "system.api.publish": {
        "post": true,
        "get": true
      }
    },
    "_pseudonymization": {
      "user": {
        "login": "text",
        "first_name": "text",
        "last_name": "text",
        "displayname": "text",
        "additional_info": "text",
        "_emails": "text"
      }
    },
    "_auth_method_group_maps": {
      "sso": [
        {
          "method": "text",
          "value": "text"
        }
      ],
      "ldap": [
        {
          "method": "text",
          "value": "text"
        }
      ],
      "system": [
        {
          "method": "text",
          "value": "text"
        }
      ]
    },
    "_ip_subnet_filter": [
      "text"
    ],
    "_ip_subnet_filter_exclude": true,
    "_owner": {
      "_basetype": "user",
      "_owner": true,
      "_pool_contact": true,
      "user": {
        "_id": 1,
        "lookup:_id": {
          "reference": "text"
        },
        "_generated_displayname": "text",
        "ANY_ADDITIONAL_PROPERTY": "anything"
      },
      "group": {
        "_id": 1,
        "lookup:_id": {
          "reference": "text"
        },
        "_generated_displayname": "text"
      }
    },
    "_created_at": "2026-06-10T15:54:14.033Z",
    "_updated_at": "2026-06-10T15:54:14.033Z",
    "_automatic_auth": {
      "type": "text",
      "timestamp": "2026-06-10T15:54:14.033Z"
    }
  }
]

DELETE /group/{id} — Delete a group by id.

Delete a group by id.

delete

A group whose type is system cannot be deleted — attempting to do so yields a 400 with code: DeleteSystemGroup.

Authorizations

BearerAuthAccessTokenQueryFylrAuthHeader

AuthorizationstringRequired

Access token in the Authorization header: Authorization: Bearer <token>.

Path parameters

idinteger · int64 · min: 1Required

The group's _id.

Responses

200

The group was deleted. The response carries the deleted group as an array of group objects (the same shape as the create / read responses).

application/json

A user group. Bundles a set of users together so the ACL system can address them collectively.

_basetypestring · enumRequired

Fixed marker identifying this object as a group.

Possible values:

_ip_subnet_filterstring[]Optional

CIDR / subnet entries. If set, members of this group can only sign in from a matching network — unless _ip_subnet_filter_exclude is true, in which case the matching networks are denied.

_ip_subnet_filter_excludebooleanOptional

Invert the meaning of _ip_subnet_filter.

_created_atstring · date-timeOptional

UTC time the group was created.

_updated_atstring · date-timeOptional

UTC time the group was last updated.

400

The request could not be processed. Common causes and their code: a group._version that is not stored version + 1 on update (VersionMismatch); creating a type: system group (GroupTypeNotAllowed) or changing a stored group's type (GroupTypeChangeNotAllowed); deleting a type: system group (DeleteSystemGroup); the instance being in read-only mode (ReadOnlyMode). A malformed payload or a group id in the URL that matches no stored group surfaces as code: ServerGeneric (there is no dedicated 404 for a missing group).

application/json

401

No authenticated user. The request must carry a valid access token.

application/json

403

The authenticated user lacks a required right. Create / update (POST / PUT) and delete (DELETE) first require the system.group (or system.root) system right; missing it yields code: SystemRightRequired with parameters.rights listing the accepted rights. A non-root user is then checked further: creating needs system.group[create] (and [create_acl] / [create_system_rights] when _acl / _system_rights are sent), editing an existing group's _acl / _system_rights needs system.group[edit_acl] / [edit_system_rights] — these also surface as SystemRightRequired. Per-group ACL failures use code: RightRequired: bag_read on read, bag_write on update, delete on delete; changing a group's owner additionally requires system.root.

application/json

[
  {
    "_basetype": "group",
    "group": {
      "_id": 1,
      "_version": 1,
      "reference": "text",
      "name": "text",
      "comment": "text",
      "category_a": "text",
      "category_b": "text",
      "category_c": "text",
      "displayname": {
        "de-DE": "Deutscher text",
        "en-US": "English text"
      },
      "frontend_prefs": {
        "ANY_ADDITIONAL_PROPERTY": "anything"
      },
      "type": "easydb",
      "lookup:_id": {
        "reference": "text"
      }
    },
    "_generated_rights": {
      "ANY_ADDITIONAL_PROPERTY": {
        "_grantable": true,
        "allow_update_and_remove": true,
        "classes": [
          "text"
        ],
        "extensions": [
          "text"
        ],
        "versions": [
          "text"
        ],
        "limit": 1,
        "mask_ids": {
          "ANY_ADDITIONAL_PROPERTY": []
        },
        "column_ids": [
          1
        ],
        "objecttype_ids": [
          1
        ],
        "pool_ids": [
          1
        ]
      }
    },
    "_acl": [
      {
        "_id": 1,
        "who": {
          "_basetype": "user",
          "_owner": true,
          "_pool_contact": true,
          "user": {
            "_id": 1,
            "lookup:_id": {
              "reference": "text"
            },
            "_generated_displayname": "text",
            "ANY_ADDITIONAL_PROPERTY": "anything"
          },
          "group": {
            "_id": 1,
            "lookup:_id": {
              "reference": "text"
            },
            "_generated_displayname": "text"
          }
        },
        "sticky": true,
        "active": true,
        "_right_preset": 1,
        "when": {
          "from": "2026-06-10T15:54:14.033Z",
          "to": "2026-06-10T15:54:14.033Z"
        },
        "rights": {
          "ANY_ADDITIONAL_PROPERTY": {
            "_grantable": true,
            "allow_update_and_remove": true,
            "classes": [
              "text"
            ],
            "extensions": [
              "text"
            ],
            "versions": [
              "text"
            ],
            "limit": 1,
            "mask_ids": {
              "ANY_ADDITIONAL_PROPERTY": []
            },
            "column_ids": [
              1
            ],
            "objecttype_ids": [
              1
            ],
            "pool_ids": [
              1
            ]
          }
        },
        "tagfilter": {
          "all": [
            1
          ],
          "any": [
            1
          ],
          "not": [
            1
          ],
          "changed": [
            1
          ]
        },
        "send_email_notification": {
          "text": "text"
        }
      }
    ],
    "_system_rights": {
      "system.user": {
        "read": true
      },
      "system.api.event": {
        "get": true
      },
      "system.api.publish": {
        "post": true,
        "get": true
      }
    },
    "_pseudonymization": {
      "user": {
        "login": "text",
        "first_name": "text",
        "last_name": "text",
        "displayname": "text",
        "additional_info": "text",
        "_emails": "text"
      }
    },
    "_auth_method_group_maps": {
      "sso": [
        {
          "method": "text",
          "value": "text"
        }
      ],
      "ldap": [
        {
          "method": "text",
          "value": "text"
        }
      ],
      "system": [
        {
          "method": "text",
          "value": "text"
        }
      ]
    },
    "_ip_subnet_filter": [
      "text"
    ],
    "_ip_subnet_filter_exclude": true,
    "_owner": {
      "_basetype": "user",
      "_owner": true,
      "_pool_contact": true,
      "user": {
        "_id": 1,
        "lookup:_id": {
          "reference": "text"
        },
        "_generated_displayname": "text",
        "ANY_ADDITIONAL_PROPERTY": "anything"
      },
      "group": {
        "_id": 1,
        "lookup:_id": {
          "reference": "text"
        },
        "_generated_displayname": "text"
      }
    },
    "_created_at": "2026-06-10T15:54:14.033Z",
    "_updated_at": "2026-06-10T15:54:14.033Z",
    "_automatic_auth": {
      "type": "text",
      "timestamp": "2026-06-10T15:54:14.033Z"
    }
  }
]