---
title: "User model"
description: "API routes use the shared base https://api.ordering.co/{version}/{lang}/{project}."
canonical: https://docs.ordering.co/api-reference/guides/users-model/
---

# User model

The `User` resource represents people and operational roles within an Ordering.co project, including administrators, business managers, customers, drivers, waiters, professionals, and call-center agents.

API routes use the shared base `https://api.ordering.co/{version}/{lang}/{project}`. Replace each variable with values authorized for your project.

## Core operations

| Action        | Method   | Resource        | Purpose                                                                |
| ------------- | -------- | --------------- | ---------------------------------------------------------------------- |
| List users    | `GET`    | `/users`        | Return users visible to the authenticated caller.                      |
| Get a user    | `GET`    | `/users/{user}` | Return one user by numeric ID.                                         |
| Create a user | `POST`   | `/users`        | Create a user under operation-specific rules.                          |
| Update a user | `POST`   | `/users/{user}` | Partially update one user. This API uses `POST`, not `PUT` or `PATCH`. |
| Delete a user | `DELETE` | `/users/{user}` | Delete one user when the caller and user state permit it.              |

Permissions, request fields, relations, responses, and errors can vary by operation.

## Sanitized request example

```bash
curl --request GET \
  --url 'https://api.ordering.co/v400/en/YOUR_PROJECT/users/42' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN'
```

All uppercase values are placeholders. Never put a real token in documentation, a URL, source control, or logs.

## Conservative public fields

The public base projection groups commonly available fields as follows. Sparse responses can omit fields, and nullable fields can be `null`.

| Group               | Representative fields                                                                     |
| ------------------- | ----------------------------------------------------------------------------------------- |
| Identity            | `id`, `name`, `middle_name`, `lastname`, `second_lastname`, `email`, `photo`, `birthdate` |
| Contact and address | `cellphone`, `country_phone_code`, `address`, `address_notes`, `zipcode`, `location`      |
| Role and status     | `level`, `busy`, `available`, `enabled`, `email_verified`, `phone_verified`               |
| Timestamps          | `created_at`, `updated_at`                                                                |

The model may contain additional fields, relations, and project extensions. They are not necessarily included in every public response.

## User levels

| Level | Meaning                                                      |
| ----- | ------------------------------------------------------------ |
| `0`   | Administrator                                                |
| `1`   | Legacy role; confirm its project-specific meaning before use |
| `2`   | Business manager                                             |
| `3`   | Customer                                                     |
| `4`   | Driver                                                       |
| `5`   | Driver manager                                               |
| `6`   | Waiter                                                       |
| `7`   | Waiter manager                                               |
| `8`   | Professional                                                 |
| `9`   | Call-center agent                                            |

Role creation, visibility, and permitted actions depend on the operation and authenticated caller.

## Field behavior

- `id` is the numeric user identifier.
- `country_phone_code` is normalized without plus signs or spaces in relevant flows.
- `location` and other structured fields can vary by operation.
- `created_at` and `updated_at` are date-time values in the current schema.
- `password` is not included in the public user response.
- Authentication tokens belong to session responses, not the `User` resource.

Where supported, `params` selects a sparse field projection; `id` remains included when a valid projection is applied.

For authentication context, see the [User authentication guide](https://docs.ordering.co/api-reference/guides/users-authentication/).

## Schema properties

**Schema:** `User`

| Name                 | Type            | Description                                                                                                                                                                          |
| -------------------- | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `address`            | string \| null  | —                                                                                                                                                                                    |
| `address_notes`      | string \| null  | —                                                                                                                                                                                    |
| `available`          | boolean \| null | —                                                                                                                                                                                    |
| `birthdate`          | string \| null  | Date with a four-digit year first.                                                                                                                                                   |
| `busy`               | boolean \| null | —                                                                                                                                                                                    |
| `cellphone`          | string \| null  | —                                                                                                                                                                                    |
| `country_phone_code` | string \| null  | Country calling code without plus signs or spaces.                                                                                                                                   |
| `created_at`         | string \| null  | —                                                                                                                                                                                    |
| `email`              | string \| null  | —                                                                                                                                                                                    |
| `email_verified`     | boolean \| null | —                                                                                                                                                                                    |
| `enabled`            | boolean \| null | —                                                                                                                                                                                    |
| `id`                 | integer \| null | —                                                                                                                                                                                    |
| `lastname`           | string \| null  | —                                                                                                                                                                                    |
| `level`              | integer \| null | 0 administrator; 1 legacy meaning pending confirmation; 2 business manager; 3 customer; 4 driver; 5 driver manager; 6 waiter; 7 waiter manager; 8 professional; 9 call-center agent. |
| `location`           | object \| null  | —                                                                                                                                                                                    |
| `middle_name`        | string \| null  | —                                                                                                                                                                                    |
| `name`               | string \| null  | —                                                                                                                                                                                    |
| `phone_verified`     | boolean \| null | —                                                                                                                                                                                    |
| `photo`              | string \| null  | —                                                                                                                                                                                    |
| `second_lastname`    | string \| null  | —                                                                                                                                                                                    |
| `updated_at`         | string \| null  | —                                                                                                                                                                                    |
| `zipcode`            | string \| null  | —                                                                                                                                                                                    |