The User API is a REST API that gets, adds and updates user/group/department information.

The User REST API requires password authentication, with the appropriate Keys and Values set in the header of the request.

The priority of authentication is as follows.

1. API token authentication
2. Password authentication
3. Session authentication

API token authentication is a method of authentication using an API token generated on the System Administration settings. To include your API token in your API requests, add it to the headers of each request as follows:

• Header Name: Authorization
• Header Value: Bearer USER_API_TOKEN

Replace USER_API_TOKEN with the actual token you received.

For example, when the API token is as follows:

1

cy.s.api1.eyJraWQiOiJ2MSIsInR5cCI6IkpXVCIsImFsZyI6IkhTMjU2In0.eyJyYW5kIjoiYzllZTRlZjAtZjI2Yi00N2VjLWI1ZWYtYThiNzBkMDU1ZDBkIiwiaXNzIjoiYzExNDkyOTc3IiwiZXhwIjoxNzg5MTAwMzcyfQ.M1ShkvH_HjHh-7Zl7ykRSeWZcXLbG7xzWuFDxgIidQ0

The request header will be as follows:

1
2
3

{
  "Authorization": "Bearer cy.s.api1.eyJraWQiOiJ2MSIsInR5cCI6IkpXVCIsImFsZyI6IkhTMjU2In0.eyJyYW5kIjoiYzllZTRlZjAtZjI2Yi00N2VjLWI1ZWYtYThiNzBkMDU1ZDBkIiwiaXNzIjoiYzExNDkyOTc3IiwiZXhwIjoxNzg5MTAwMzcyfQ.M1ShkvH_HjHh-7Zl7ykRSeWZcXLbG7xzWuFDxgIidQ0"
}

Password authentication is a method of authentication using a user's login name and password. To use password authentication, add it to the headers as follows:

• Header Name: X-Cybozu-Authorization
• Header Value: A BASE64 encoded LOGIN_NAME:PASSWORD

For example, when the login name is "Kintone" and your password is "developer", BASE64 encode "Kintone:developer" and set it on the header as follows:

1
2
3

{
  "X-Cybozu-Authorization": "S2ludG9uZTpkZXZlbG9wZXI="
}

Session authentication is a method of authentication where a session ID is assigned to a user by the web server and saved as a cookie. This cookie is used to identify and authenticate the user.

Method 1: Using kintone.api()

When executing the Kintone REST API from a JavaScript code, session authentication can be used.

For more information on the Kintone REST API Request method, refer to the following article:
Kintone REST API Request

kintone.api() cannot be used with APIs that upload or download files.

Add it to the headers as follows:

• Header Name: X-Requested-With
• Header Value: XMLHttpRequest or strings that are not empty

For example, when the value is XMLHttpRequest, set it on the header as follows:

1
2
3

{
  "X-Requested-With": "XMLHttpRequest"
}

For more information on the X-Requested-With header, refer to the following article:
X-Requested-With

In addition to the X-Requested-With header, CSRF tokens are necessary when using Session Authentication with POST／PUT／DELETE methods. Refer to the following documentation for more details on retrieving a CSRF token:
Get CSRF Token

Warning

As of June 2020, Basic Authentication has been deprecated, and is no longer available for use.

If your Kintone environment has set the Basic authentication security feature, add Authorization in the request header, with the string Basic and a BASE64 encoded login name and password of the Basic authentication as the value.
If the basic authentication log in name is "chocolate" and the basic authentication password is "pudding", place "Basic" in the value, followed by a BASE64 encoded "chocolate:pudding" as follows:

1

Authorization: Basic Y2hvY29sYXRlOnB1ZGRpbmc=

These request headers are used for the REST API.

HTTP status code 200 denotes that the request was successful.
If the request fails, a status code other than 200 and an error response will be returned.

An object with the following properties is returned in JSON format.

KEY	VALUE
code	The code of the error, to specify the type of error it is.
id	The ID of the error.
message	The error message. The language of the message will differ depending on the user's language settings of the Kintone user used for the authentication. Switching to Different Display Language

Sample Error Response

1
2
3
4
5

{
  "code": "CB_IJ01",
  "id": "1505999166-897850006",
  "message": "Invalid JSON string."
}

Kintone REST API Request can be used to run the User API.

For more information on the Kintone REST API Request method, refer to the following article:
Kintone REST API Request

• Add the X-HTTP-Method-Override header to work around the Request URI Too Large error that occurs when the request URI exceeds 4KB. All User APIs support this header.
• If a GET request of a User API is sent using the Kintone REST API Request method, and the URI length exceeds 4KB, the X-HTTP-Method-Override header will automatically be added and the request will be sent as a POST request. This allows User API requests with long URIs to be executed without errors.