API ‐ Users

🔑 Authentication API

• POST /api/auth/token – Authenticates a user using email and password, returning a JWT token.
  The token must be included in the Authorization header as a Bearer token for API requests.

👥 User Management API (Admin Only)

• POST /api/users – Create a new user.
• PUT /api/users/{email} – Update user details.
• PATCH /api/users/{email} – Change a user’s password.
• DELETE /api/users/{email} – Soft-delete a user (users remain in the database but cannot be restored).

🔑 User Management Rules

• ✔️ Only admin users can manage other users.
• ✔️ Admins can create, modify, activate, and deactivate accounts.
• ✔️ Admins can promote or demote users.
• ✔️ Only active users can interact with the API.
• ✔️ Deleting a user is a soft delete – the user remains in the database but cannot be restored.
• ✔️ A new user with the same email can be created after deletion.