Automating user management using Striim APIs

A user's status determines whether the user can sign in and whether federation can complete. Use the list users API to check the current status.

Roles control what a user can do in the Striim Cloud control plane. The API accepts role names case-insensitively; the examples in this topic use the canonical values.

Federation grants a control plane user access to a Striim Cloud service. When you federate a user to a running service, Striim Cloud adds the user to that service. Federation can also remain pending.

Returns the users in the account. Use the query parameters to filter by role, state, or name.

curl -X GET "$BASE_URL/users?role=Developer&state=active&page=0&size=20" \
  -H "Authorization: Bearer $TOKEN"

The response lists each user with an ID, email address, and status.

{
  "users": [
    { "user-id": 123, "email": "user@example.com", "status": "active" },
    { "user-id": 456, "email": "pending@example.com", "status": "pending" }
  ]
}

Invites a user to join a Striim Cloud account. If the user is already pending, the API re-sends the invitation.

When SSO is configured, this API is available only if invitation-based sign-in, also known as basic authentication, is enabled for the account.

curl -X POST "$BASE_URL/user" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "newuser@example.com",
    "role-name": "Developer"
  }'

{
  "message": "Successfully invited new user newuser@example.com"
}

Updates a user's control plane role. Identify the user by either user-id or email, but not both.

curl -X PUT "$BASE_URL/user/role" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "user@example.com",
    "role-name": "Admin"
  }'

{
  "user-id": 456,
  "role-name": "Admin",
  "message": "user role updated successfully"
}

Removes a user from the Striim Cloud account, along with the user's active service federations and pending federation requests.

curl -X DELETE "$BASE_URL/user/456" \
  -H "Authorization: Bearer $TOKEN"

A successful request returns 204 No Content with no response body.

Revoke a user's PAT when the token is no longer required or may have been exposed.

curl -X DELETE "$BASE_URL/user-token?email=user@example.com" \
  -H "Authorization: Bearer $TOKEN"

For more information about token management, see Managing API tokens in Striim Cloud.

Returns the services in the account. Use this endpoint before federating users, to determine the target service names or IDs.

curl -X GET "$BASE_URL/services?state=running&size=50" \
  -H "Authorization: Bearer $TOKEN"

{
  "services": [
    { "id": 400, "name": "my-pipeline", "state": "running" },
    { "id": 401, "name": "backup-pipeline", "state": "stopped" }
  ]
}

Federates a user to one or more services. Administrators and service account tokens with admin access can federate any user in the account. A user PAT can be used only for supported self-federation actions, and the user must have a role that can be federated.

curl -X POST "$BASE_URL/services/user/federate" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "user@example.com",
    "services": ["serv1", "serv2", "serv3"]
  }'

Removes a user's service federation, which removes the user's access to the specified services.

Pending federation is handled in the same way as active federation, except that a user who has not activated the account cannot be removed from a federation that has not yet been created.

curl -X POST "$BASE_URL/services/user/revoke" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "user-id": 123,
    "services": ["serv1", "serv2"]
  }'

Returns the active and pending users for a service. Use this endpoint after federating or removing a user to verify the result and identify the reason for any pending federation.

curl -X GET "$BASE_URL/services/400/users?user-id=123" \
  -H "Authorization: Bearer $TOKEN"

{
  "id": 400,
  "name": "my-pipeline",
  "federated-users": [
    {
      "user-id": 123,
      "username": "striim_user_123",
      "is-admin": false,
      "state": "done",
      "created-at": "2026-06-23T10:30:00Z"
    }
  ],
  "pending-users": [
    {
      "user-id": 456,
      "email": "newuser@example.com",
      "reason": "User not activated yet",
      "created-at": "2026-06-23T10:35:00Z"
    }
  ]
}

Pending reasons include User not activated yet and Service in stopped state. When the user activates the account or the service starts, Striim Cloud completes the pending federation automatically.

Creates a service account token. You can optionally set the token expiry, administrator scope, and the services to which the service account is federated.

curl -X POST "$BASE_URL/service-account" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "ci-pipeline",
    "description": "Token for CI/CD automation",
    "expires-at": "2027-02-09T00:00:00Z",
    "is-admin": true,
    "services": ["serv1", "serv2"]
  }'

{
  "token-id": 12345,
  "name": "ci-pipeline",
  "token": "9AbCdEfG3h4I.jKlMn-OpQrStUvWx",
  "expires-at": "2027-02-09T00:00:00Z"
}

Changes whether a service account has administrator scope. Identify the service account by name in the query string and provide the new is-admin value in the request body.

curl -X PUT "$BASE_URL/service-account/role?name=ci-pipeline" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "is-admin": true
  }'

{
  "is-admin": true
}

Federates a service account to one or more services. Use this API when the automation needs access to additional services in the data plane.

curl -X POST "$BASE_URL/services/service-account/federate" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "service-account-prd",
    "services": ["serv1", "serv2", "serv3"]
  }'

{
  "name": "service-account-prd",
  "service-ids": [15260, 14662]
}

Removes a service account from one or more services. Use this API when automation no longer needs access to a service, or before you re-federate the service account after a role change.

curl -X DELETE "$BASE_URL/services/service-account/revoke" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "service-account-prd",
    "services": ["serv1", "serv2"]
  }'

{
  "name": "service-account-prd",
  "service-ids": [15260, 14662]
}

The following situations account for most failed or incomplete automation runs.