Skip to main content

User Service – API Reference 👤

This document describes the public and admin APIs exposed by the User Service in ShopVerse.

All APIs are accessed via the API Gateway, and user identity is propagated using gateway-injected headers.

🌐 Base URL​


/api/users

🔐 Authentication & Authorization​

  • JWT is validated at the API Gateway
  • Gateway injects:
    • X-User-Email
    • X-User-Role
  • User Service trusts only gateway headers
  • Role-Based Access Control (RBAC) is enforced

👤 Get Current User Profile​

Fetch the profile of the currently authenticated user.

➤ Endpoint​


GET /api/users/me

➤ Headers​


Authorization: Bearer <JWT>

➤ Success Response (200 OK)​

{
  "id": 1,
  "fullName": "John Doe",
  "email": "john@example.com",
  "phoneNo": "9876543210",
  "role": "CUSTOMER",
  "createdAt": "2026-01-10T10:15:00"
}

➤ Error Responses​

StatusReason
401Unauthorized
500Internal server error

✏️ Update User Profile​

Update profile details of the current user.

➤ Endpoint​

PUT /api/users/me

➤ Request Body​

{
  "fullName": "John Updated",
  "phoneNo": "9123456789"
}

➤ Success Response (200 OK)​

{
  "message": "Profile updated successfully"
}

➤ Error Responses​

StatusReason
400Invalid input
403Forbidden
500Internal server error

🏠 Add Address​

Add a new address for the authenticated user.

➤ Endpoint​

POST /api/users/addresses

➤ Request Body​

{
  "street": "MG Road",
  "city": "Pune",
  "state": "Maharashtra",
  "pincode": "411001"
}

➤ Success Response (201 CREATED)​

{
  "message": "Address added successfully"
}

📍 Get User Addresses​

Fetch all addresses belonging to the authenticated user.

➤ Endpoint​

GET /api/users/addresses

➤ Success Response (200 OK)​

[
  {
    "id": 101,
    "street": "MG Road",
    "city": "Pune",
    "state": "Maharashtra",
    "pincode": "411001"
  }
]

📝 Update Address​

Update an existing address owned by the user.

➤ Endpoint​

PUT /api/users/addresses/{addressId}

➤ Request Body​

{
  "street": "FC Road",
  "city": "Pune",
  "state": "Maharashtra",
  "pincode": "411004"
}

➤ Success Response (200 OK)​

{
  "message": "Address updated successfully"
}

❌ Delete Address​

Delete an address owned by the user.

➤ Endpoint​

DELETE /api/users/addresses/{addressId}

➤ Success Response (204 NO CONTENT)​

👑 Admin – Get All Users​

Fetch all users (admin-only).

➤ Endpoint​

GET /api/users

➤ Role Required​

ADMIN

➤ Success Response (200 OK)​

[
  {
    "id": 1,
    "email": "admin@shopverse.com",
    "role": "ADMIN"
  },
  {
    "id": 2,
    "email": "user@shopverse.com",
    "role": "CUSTOMER"
  }
]

❌ Admin – Delete User​

Delete a user by ID (admin-only).

➤ Endpoint​

DELETE /api/users/{userId}

➤ Role Required​

ADMIN

➤ Success Response (204 NO CONTENT)​

🛡️ Authorization Rules Summary​

RoleAllowed Actions
CUSTOMERManage own profile & addresses
ADMINManage all users

Ownership is enforced using X-User-Email.

🔄 Request Flow​

⚠️ Common Errors​

StatusMeaning
401Invalid or missing token
403Access denied
404Resource not found
409Conflict (duplicate data)

📌 Summary​

The User API provides:

  • Secure access to user profiles
  • Strict ownership enforcement
  • Clean separation of admin and user actions
  • Gateway-based authentication trust model

It ensures user data integrity and security in ShopVerse.