Update user settings

curl --request PATCH \
  --url https://semgrep.dev/api/auth/users/current/settings \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "userId": "<string>",
  "primaryEmail": "<string>",
  "hasAcceptedToc": true,
  "subscribe": true,
  "contactAboutExperiments": true,
  "usedCliLogin": true,
  "hasCompletedFindingsTour": true,
  "hasCompletedSupplyChainTour": true,
  "tourStates": [
    {}
  ]
}
'

import requests

url = "https://semgrep.dev/api/auth/users/current/settings"

payload = {
    "userId": "<string>",
    "primaryEmail": "<string>",
    "hasAcceptedToc": True,
    "subscribe": True,
    "contactAboutExperiments": True,
    "usedCliLogin": True,
    "hasCompletedFindingsTour": True,
    "hasCompletedSupplyChainTour": True,
    "tourStates": [{}]
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PATCH',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    userId: '<string>',
    primaryEmail: '<string>',
    hasAcceptedToc: true,
    subscribe: true,
    contactAboutExperiments: true,
    usedCliLogin: true,
    hasCompletedFindingsTour: true,
    hasCompletedSupplyChainTour: true,
    tourStates: [{}]
  })
};

fetch('https://semgrep.dev/api/auth/users/current/settings', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://semgrep.dev/api/auth/users/current/settings",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'userId' => '<string>',
    'primaryEmail' => '<string>',
    'hasAcceptedToc' => true,
    'subscribe' => true,
    'contactAboutExperiments' => true,
    'usedCliLogin' => true,
    'hasCompletedFindingsTour' => true,
    'hasCompletedSupplyChainTour' => true,
    'tourStates' => [
        [
                
        ]
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://semgrep.dev/api/auth/users/current/settings"

	payload := strings.NewReader("{\n  \"userId\": \"<string>\",\n  \"primaryEmail\": \"<string>\",\n  \"hasAcceptedToc\": true,\n  \"subscribe\": true,\n  \"contactAboutExperiments\": true,\n  \"usedCliLogin\": true,\n  \"hasCompletedFindingsTour\": true,\n  \"hasCompletedSupplyChainTour\": true,\n  \"tourStates\": [\n    {}\n  ]\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.patch("https://semgrep.dev/api/auth/users/current/settings")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"userId\": \"<string>\",\n  \"primaryEmail\": \"<string>\",\n  \"hasAcceptedToc\": true,\n  \"subscribe\": true,\n  \"contactAboutExperiments\": true,\n  \"usedCliLogin\": true,\n  \"hasCompletedFindingsTour\": true,\n  \"hasCompletedSupplyChainTour\": true,\n  \"tourStates\": [\n    {}\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://semgrep.dev/api/auth/users/current/settings")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"userId\": \"<string>\",\n  \"primaryEmail\": \"<string>\",\n  \"hasAcceptedToc\": true,\n  \"subscribe\": true,\n  \"contactAboutExperiments\": true,\n  \"usedCliLogin\": true,\n  \"hasCompletedFindingsTour\": true,\n  \"hasCompletedSupplyChainTour\": true,\n  \"tourStates\": [\n    {}\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "user": {
    "id": "<string>",
    "name": "<string>",
    "email": "<string>",
    "login": "<string>",
    "authDetails": [
      {
        "providerId": "<string>",
        "providerType": "<string>",
        "sourceId": "<string>",
        "current": true,
        "expiresAt": "2023-11-07T05:31:56Z",
        "authProviderId": "<string>"
      }
    ],
    "orgRole": "<string>",
    "deletedAt": "2023-11-07T05:31:56Z"
  }
}

PATCH

api

auth

users

current

settings

Update user settings

curl --request PATCH \
  --url https://semgrep.dev/api/auth/users/current/settings \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "userId": "<string>",
  "primaryEmail": "<string>",
  "hasAcceptedToc": true,
  "subscribe": true,
  "contactAboutExperiments": true,
  "usedCliLogin": true,
  "hasCompletedFindingsTour": true,
  "hasCompletedSupplyChainTour": true,
  "tourStates": [
    {}
  ]
}
'

import requests

url = "https://semgrep.dev/api/auth/users/current/settings"

payload = {
    "userId": "<string>",
    "primaryEmail": "<string>",
    "hasAcceptedToc": True,
    "subscribe": True,
    "contactAboutExperiments": True,
    "usedCliLogin": True,
    "hasCompletedFindingsTour": True,
    "hasCompletedSupplyChainTour": True,
    "tourStates": [{}]
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PATCH',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    userId: '<string>',
    primaryEmail: '<string>',
    hasAcceptedToc: true,
    subscribe: true,
    contactAboutExperiments: true,
    usedCliLogin: true,
    hasCompletedFindingsTour: true,
    hasCompletedSupplyChainTour: true,
    tourStates: [{}]
  })
};

fetch('https://semgrep.dev/api/auth/users/current/settings', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://semgrep.dev/api/auth/users/current/settings",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'userId' => '<string>',
    'primaryEmail' => '<string>',
    'hasAcceptedToc' => true,
    'subscribe' => true,
    'contactAboutExperiments' => true,
    'usedCliLogin' => true,
    'hasCompletedFindingsTour' => true,
    'hasCompletedSupplyChainTour' => true,
    'tourStates' => [
        [
                
        ]
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://semgrep.dev/api/auth/users/current/settings"

	payload := strings.NewReader("{\n  \"userId\": \"<string>\",\n  \"primaryEmail\": \"<string>\",\n  \"hasAcceptedToc\": true,\n  \"subscribe\": true,\n  \"contactAboutExperiments\": true,\n  \"usedCliLogin\": true,\n  \"hasCompletedFindingsTour\": true,\n  \"hasCompletedSupplyChainTour\": true,\n  \"tourStates\": [\n    {}\n  ]\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.patch("https://semgrep.dev/api/auth/users/current/settings")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"userId\": \"<string>\",\n  \"primaryEmail\": \"<string>\",\n  \"hasAcceptedToc\": true,\n  \"subscribe\": true,\n  \"contactAboutExperiments\": true,\n  \"usedCliLogin\": true,\n  \"hasCompletedFindingsTour\": true,\n  \"hasCompletedSupplyChainTour\": true,\n  \"tourStates\": [\n    {}\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://semgrep.dev/api/auth/users/current/settings")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"userId\": \"<string>\",\n  \"primaryEmail\": \"<string>\",\n  \"hasAcceptedToc\": true,\n  \"subscribe\": true,\n  \"contactAboutExperiments\": true,\n  \"usedCliLogin\": true,\n  \"hasCompletedFindingsTour\": true,\n  \"hasCompletedSupplyChainTour\": true,\n  \"tourStates\": [\n    {}\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "user": {
    "id": "<string>",
    "name": "<string>",
    "email": "<string>",
    "login": "<string>",
    "authDetails": [
      {
        "providerId": "<string>",
        "providerType": "<string>",
        "sourceId": "<string>",
        "current": true,
        "expiresAt": "2023-11-07T05:31:56Z",
        "authProviderId": "<string>"
      }
    ],
    "orgRole": "<string>",
    "deletedAt": "2023-11-07T05:31:56Z"
  }
}

This endpoint is experimental. It may change or be removed without notice and is not covered by API stability guarantees.

Authorizations

Authorization

string

header

required

Get access to data with your user's JSON Web Token.

Body

application/json

userId

string

NOTE: Field number is nonsequential because it was added later. But it's first because it's a path param. The user ID to fetch settings for. NOTE: As of June 2025, it must be equal to the requester's ID.

primaryEmail

string

the user's currently selected email address

hasAcceptedToc

boolean

if the user has accepted the terms of service

if the user is subscribed to emails

contactAboutExperiments

boolean

if the user would like to be contacted about product experiments

if the user has used the CLI to login

hasCompletedFindingsTour

boolean

if the user has completed the findings product tour, deprecated (see findings_tour_state)

hasCompletedSupplyChainTour

boolean

if the user has completed the supply chain product tour, deprecated (see supply_chain_tour_state)

findingsTourState

enum<string>

the completion state of the findings product tour

value	description
TOUR_STATE_INCOMPLETE
TOUR_STATE_COMPLETE
TOUR_STATE_SKIPPED

Available options:

TOUR_STATE_INCOMPLETE,

TOUR_STATE_COMPLETE,

TOUR_STATE_SKIPPED

supplyChainTourState

enum<string>

the completion state of the supply chain product tour

value	description
TOUR_STATE_INCOMPLETE
TOUR_STATE_COMPLETE
TOUR_STATE_SKIPPED

Available options:

TOUR_STATE_INCOMPLETE,

TOUR_STATE_COMPLETE,

TOUR_STATE_SKIPPED

supplyChainFindingsTourState

enum<string>

the completion state of the supply chain product tour

value	description
TOUR_STATE_INCOMPLETE
TOUR_STATE_COMPLETE
TOUR_STATE_SKIPPED

Available options:

TOUR_STATE_INCOMPLETE,

TOUR_STATE_COMPLETE,

TOUR_STATE_SKIPPED

eventSource

enum<string>

capture the event source, which may be passed as a query param (e.g. ?event_source=Welcome)

value	description
Welcome
Findings
ExistingScaUserVulnsTour
NewScaUserVulnsTour
AccountSettingsPanel
Vulns
useOnboardingTaskData
AiScanTour
AutofixIntro
ScaAutofixIntro
MultimodalBanner
CombinedFindings
WorkflowsActivationBanner

Available options:

Welcome,

Findings,

ExistingScaUserVulnsTour,

NewScaUserVulnsTour,

AccountSettingsPanel,

Vulns,

useOnboardingTaskData,

AiScanTour,

AutofixIntro,

ScaAutofixIntro,

MultimodalBanner,

CombinedFindings,

WorkflowsActivationBanner

tourStates

object[]

scalable structure for tour states

Show child attributes

Response

200 - application/json

user

object

Show child attributes

Overview

Endpoints

Update user settings

Authorizations

Body

Response