Get main profile

Get Main Profile

The Get Main Profile endpoint retrieves the complete profile of the currently authenticated user, including identity details, access rights, notification preferences, card design settings, and loan-related metadata. This endpoint is the primary way for a partner application to confirm who is logged in and what features they have access to. A valid Bearer token is required; the response reflects the exact user associated with that token.

Endpoint

GET /api/users

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint immediately after authentication to load the user's profile in your application shell or dashboard. It is also useful when you need to check a user's access rights, module permissions, two-factor authentication settings, or funding eligibility before rendering feature-specific UI. Call it any time you need to refresh the in-memory profile state (e.g., after a settings update).

Response

200 OK

Field	Type	Description
id	integer	Internal numeric ID of the user record
nickName	string	Display name or alias for the user
email	string	Registered email address
twoFactorAuthenticationEnabled	boolean	Whether 2FA is currently active (read-only)
twoFactorAuthenticationType	string	2FA method: `ShortMessageCode`, `TimeBasedCode`, or `LegacyTimeBasedCode`
type	integer	User type code (1–5); maps to user category within the platform
givenName	string	User's first name
middleName	string	User's middle name
familyName	string	User's last name
agentPayoutId	integer	ID of the associated agent payout record, if applicable
accessRights	object	Object describing the user's permission flags (see below)
accessRights.id	integer	ID of the access rights record
accessRights.mainAccess	boolean	Whether the user has main account access
accessRights.openBankingCard	boolean	Whether the user can open a payment card
accessRights.openFinancialAccount	boolean	Whether the user can open a financial account
accessRights.viewAllCardsAndFinancialAccounts	boolean	Whether the user can view all cards and accounts
accessRights.makeTransfers	boolean	Whether the user can initiate transfers
systemModuleAccess	integer[]	List of system module type codes the user can access
userModuleAccess	integer[]	List of user module type codes the user can access
isoId	integer	ISO office ID associated with the user, if applicable
deletedAt	string (date-time)	Timestamp of soft deletion, null if active
linkedAccounts	array	List of linked account tuples (string + int32 pairs)
accessToProductFunding	boolean	Whether the user has access to business funding (loans)
isOriginalUser	boolean	True if this is the primary account holder (not a subprofile)
isPasswordChangeRequired	boolean	Whether the user is required to change their password
marketingLink	string	Partner-specific marketing URL, if configured
isNotLoan	boolean	True if the user is not enrolled in a loan product
productId	string	ID of the associated product, if applicable
productFundingId	string	ID of the associated funding product, if applicable
statusApplication	string	Business funding application status: `New`, `Submitted`, `PendingUW`, `ApprovedUW`, `Closed`, `Cancelled`, `Pending_Review`, `Denied`, `Approved`, `Pending`, `InReview`, `AutoApprovedUW`
exportedLoanServie	string (date-time)	Date the loan data was exported to the servicing system
isShowRequestLoan	boolean	Whether the "request loan" UI feature should be shown (read-only)
partnerVisibleName	string	Display name of the partner (read-only)
cardProfileSets	array	List of card profile set associations; each entry has `id` (string) and `isDefault` (boolean)
loanSetting	object	Loan configuration object (see below)
loanSetting.userProfileId	integer	User profile this loan setting belongs to
loanSetting.expiration	string (date-time)	Expiration date of the loan offer
loanSetting.setting	string	Raw loan setting JSON or descriptor
loanSetting.options	array	Available loan options (amount, fee, sweep, repayment days, etc.)
loanSetting.leadId	string	External lead identifier
loanSetting.offerId	string	Loan offer identifier
loanSetting.signUrl	string	URL for loan document signing
loanSetting.isDismiss	boolean	Whether the loan prompt has been dismissed
loanSetting.isAccepted	boolean	Whether the loan offer was accepted
metaData	object	Key-value map of partner-defined metadata strings (read-only)
partnerProfilePointsId	integer	ID of the rewards/points profile, if applicable
profileId	integer	Canonical profile ID (read-only)
dba	string	"Doing Business As" name for business customers (read-only)
feeId	integer	ID of the fee schedule applied to this user (read-only)
feeName	string	Name of the applied fee schedule (read-only)
cardDesign	object	Card design image URLs for standard and burner cards
cardDesign.frontSideImageUrlXs	string	Small front-side card image URL
cardDesign.frontSideImageUrlXl	string	Large front-side card image URL
cardDesign.backSideImageUrlXl	string	Large back-side card image URL
cardDesign.burnerFrontSideImageUrlXs	string	Small front-side burner card image URL
cardDesign.burnerFrontSideImageUrlXl	string	Large front-side burner card image URL
cardDesign.burnerBackSideImageUrlXl	string	Large back-side burner card image URL
notificationSettings	object	User notification preferences (see below)
notificationSettings.id	integer	ID of the notification settings record
notificationSettings.emailEnabled	boolean	Whether email notifications are enabled
notificationSettings.pushEnabled	boolean	Whether push notifications are enabled
notificationSettings.twoFactorAuthenticationType	string	2FA delivery method used for secure operations
notificationSettings.oneTimeConfirmationEnabled	boolean	Whether one-time confirmation codes are enabled
isoName	object	Office information object with `officeId` (integer) and `name` (string)
agentName	object	Agent record with `id`, `name`, `agentName`, `agentId`, `agentOfficeId`, `agentOfficeName`
agentPayout	array	List of agent payout records (read-only)
partnerSettings	object	Partner-level settings; includes `disable.value` (boolean) and disable options

{
  "id": 10042,
  "nickName": "jane.doe",
  "email": "[email protected]",
  "twoFactorAuthenticationEnabled": true,
  "twoFactorAuthenticationType": "ShortMessageCode",
  "type": 2,
  "givenName": "Jane",
  "middleName": "A",
  "familyName": "Doe",
  "agentPayoutId": null,
  "accessRights": {
    "id": 301,
    "mainAccess": true,
    "openBankingCard": true,
    "openFinancialAccount": true,
    "viewAllCardsAndFinancialAccounts": true,
    "makeTransfers": true
  },
  "systemModuleAccess": [0, 1, 3, 5],
  "userModuleAccess": [0, 1, 2],
  "isoId": null,
  "deletedAt": null,
  "linkedAccounts": [],
  "accessToProductFunding": true,
  "isOriginalUser": true,
  "isPasswordChangeRequired": false,
  "marketingLink": null,
  "isNotLoan": false,
  "productId": "prod_abc123",
  "productFundingId": null,
  "statusApplication": "Approved",
  "exportedLoanServie": null,
  "isShowRequestLoan": false,
  "partnerVisibleName": "Acme Financial",
  "cardProfileSets": [
    { "id": "cps_001", "isDefault": true }
  ],
  "loanSetting": {
    "id": 77,
    "createdDate": "2024-11-01T09:00:00Z",
    "updatedDate": "2025-01-15T14:22:00Z",
    "userProfileId": 10042,
    "expiration": "2025-06-30T23:59:59Z",
    "setting": "{\"maxAmount\":50000}",
    "options": [
      {
        "amount": 25000.00,
        "fee": 1250.00,
        "currencyISOCode": "USD",
        "fundedAmount": 23750.00,
        "sweep": 0.10,
        "expiration": "2025-06-30T23:59:59Z",
        "isApproved": true,
        "daysUntilRepayment": 90,
        "offerId": "offer_xyz789",
        "daysUntilMaturity": 180
      }
    ],
    "leadId": "lead_001",
    "ownerId": "owner_001",
    "documentId": "doc_001",
    "offerId": "offer_xyz789",
    "preAprovalId": null,
    "signUrl": "https://sign.example.com/doc_001",
    "isDismiss": false,
    "automatedDismissDate": null,
    "isSubmitStage1Success": true,
    "isAccepted": true
  },
  "metaData": {
    "onboardingSource": "web",
    "referralCode": "REF2024"
  },
  "partnerProfilePointsId": 5501,
  "profileId": 10042,
  "dba": "Jane Doe Consulting",
  "feeId": 12,
  "feeName": "Standard Business Fee",
  "cardDesign": {
    "frontSideImageUrlXs": "https://cdn.example.com/cards/front_xs.png",
    "frontSideImageUrlXl": "https://cdn.example.com/cards/front_xl.png",
    "backSideImageUrlXl": "https://cdn.example.com/cards/back_xl.png",
    "burnerFrontSideImageUrlXs": "https://cdn.example.com/cards/burner_front_xs.png",
    "burnerFrontSideImageUrlXl": "https://cdn.example.com/cards/burner_front_xl.png",
    "burnerBackSideImageUrlXl": "https://cdn.example.com/cards/burner_back_xl.png"
  },
  "notificationSettings": {
    "id": 88,
    "emailEnabled": true,
    "pushEnabled": true,
    "pushTokens": [],
    "twoFactorAuthenticationType": "ShortMessageCode",
    "oneTimeConfirmationKey": null,
    "oneTimeConfirmationEnabled": false,
    "dateSetOTP": null
  },
  "isoName": {
    "officeId": 4,
    "name": "West Region Office"
  },
  "agentName": {
    "id": 9,
    "name": "Acme Agent",
    "agentName": "John Smith",
    "agentId": 9,
    "agentOfficeId": 4,
    "agentOfficeName": "West Region Office"
  },
  "agentPayout": [],
  "partnerSettings": {
    "disable": {
      "value": false,
      "options": {
        "disableCustomers": false,
        "disableCustomerCreation": false
      }
    }
  }
}

Error Codes

Code	When it happens
401	Token missing, expired, or invalid
403	Insufficient permissions to access this profile
500	Internal server error

Common Mistakes

Sending an expired token — the Bearer token has a 10-minute lifetime; use POST /api/auth/refresh before it expires to avoid 401 errors.
Using Basic auth instead of Bearer auth — this endpoint requires a JWT Bearer token in the Authorization header, not a username/password pair.
Treating cardIcon and cardIconLarge as current fields — these properties are deprecated; use the cardDesign object instead for card image URLs.
Assuming the response always contains loan data — loanSetting and funding fields are only populated for business customers with an active or pending loan product; check accessToProductFunding first.
Confusing id with profileId — both are present in the response; profileId is the canonical read-only profile identifier, while id is the internal user record ID.

Related Endpoints

POST /api/auth/v2 — Obtain a Bearer token using username, password, and partnerId
POST /api/auth/refresh — Refresh an expiring Bearer token
GET /api/users/sub-profiles — List authorized users (subprofiles) attached to a business account
PUT /api/users — Update the authenticated user's profile information

Example

curl -X GET https://api.banking.netevia.dev/api/users \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Accept: application/json"