Your server manages every user of one tenant with a secret credential, a client_credentials access token, which must never reach a browser. For a signed-in user changing their own details, use the User API. Not sure this is the right API? See Choosing an API.
Send a client_credentials access token as Authorization: Bearer …. Each operation needs one of these scopes:
users:read: Read usersusers:write: Create, update, and delete usersErrors share one JSON shape with a stable error code. Every code and its fix is listed in Errors.
Download the spec as JSON or YAML, or read this page as markdown. The reference below is rendered from the same spec, and the API is tested against it. Point your client generator, editor or agent at https://api.authalla.com/api/v1/openapi.json.
To try requests, import that URL into Postman (Import → Link), Bruno (Import Collection → OpenAPI V3 Spec) or Insomnia (Import → URL), then set the bearer token on the collection.