API resources

Accounts

An account is how a person signs in to fepli. Families use one to apply for their children; organisers' team members and admins use one to work in the admin. The API shows accounts the way the admin's Accounts section does.

All account endpoints need ROLE_ADMIN.

The account model

Name
uuid
Type
string
Description
The account's identifier.
Name
email
Type
string
Description
The e-mail address the person signs in with. Accepted wherever an account is named, as in ?account=familie.mueller@example.org.
Name
firstname
Type
string
Description
The first name.
Name
lastname
Type
string
Description
The last name.
Name
name
Type
string
Description
The full name.
Name
phone
Type
string
Description
The phone number.
Name
mobile
Type
string
Description
The mobile number.
Name
roles
Type
string[]
Description
The account's roles: ROLE_MEMBER for families, ROLE_HOST for organiser team members, ROLE_ADMIN and the admin roles for the team.
Name
locale
Type
string
Description
The language the person uses fepli in, such as de.
Name
disabled
Type
boolean
Description
Whether the account is suspended and can't sign in.
Name
activatedAt
Type
timestamp
Description
When the person confirmed their e-mail address.
Name
lastLogin
Type
timestamp
Description
When the person last signed in.
Name
createdAt
Type
timestamp
Description
When the account was created.
Name
modifiedAt
Type
timestamp
Description
When the account was last changed.
Name
blockedEmail
Type
boolean
Description
Whether e-mails to this address bounced. fepli stops sending to blocked addresses, which explains many "I never got an e-mail" cases. See Unblock an e-mail address.
Name
unsubscribed
Type
boolean
Description
Whether the person unsubscribed from e-mails sent by fepli.
Name
hasPassword
Type
boolean
Description
Whether the person has set a password. Without one, they sign in with a link sent by e-mail.
Name
magicLinksDisabled
Type
boolean
Description
Whether signing in by e-mail link is switched off for this account.
Name
addresses
Type
object[]
Description
Postal addresses, each with street, postalCode, city and country. An empty address appears as null in the list.
Name
hosts
Type
reference[]
Description
The organisers this account is a team member of.
Name
participants
Type
reference[]
Description
The participants, usually the children, of this account.
Name
sharedOffers
Type
reference[]
Description
Single offers that were shared with this account directly.
Name
debtor
Type
object
Description
The family's ledger, created with their first application: its uuid and balance in cents.
Name
piiMasked
Type
boolean
Description
Whether personal data was left out because you may not see it. See Masked personal data.

GET/accounts

List all accounts

Returns a page of accounts, ordered by last name and first name.

Optional filters

Name
q
Type
string
Description
Only accounts whose name or e-mail address contains this text.
Name
email
Type
string
Description
Only the account with exactly this e-mail address.
Name
role
Type
string
Description
Only accounts with this role: member, host or admin.
Name
host
Type
string
Description
Only team members of this organiser (UUID or alias).
Name
disabled
Type
boolean
Description
true for suspended accounts only.
Name
modifiedSince
Type
timestamp
Description
Only accounts changed since this moment.
Name
page, itemsPerPage
Type
integer
Description
See Pagination.

Request

GET·/accounts

curl -G https://ferienpass-musterstadt.de/api/accounts \
  -H "Authorization: Bearer $FEPLI_TOKEN" \
  --data-urlencode "email=familie.mueller@example.org"

Response

[
  {
    "uuid": "0191c7b2-4d5e-7f60-8a1b-2c3d4e5f6a05",
    "email": "familie.mueller@example.org",
    "firstname": "Anna",
    "lastname": "Müller",
    "name": "Anna Müller",
    "mobile": "0170 1234567",
    "roles": ["ROLE_MEMBER"],
    "locale": "de",
    "disabled": false,
    "activatedAt": "2025-06-02T19:14:08+02:00",
    "lastLogin": "2026-09-18T07:41:55+02:00",
    "createdAt": "2025-06-02T19:12:40+02:00",
    "modifiedAt": "2026-09-01T12:00:17+02:00",
    "blockedEmail": false,
    "unsubscribed": false,
    "hasPassword": false,
    "magicLinksDisabled": false,
    "addresses": [
      {
        "street": "Lindenallee 12",
        "postalCode": "12345",
        "city": "Musterstadt",
        "country": "de"
      }
    ],
    "hosts": [],
    "participants": [
      { "uuid": "0191c7b3-1f2a-7c4d-8e5f-6a7b8c9d0e06", "name": "Lena Müller" },
      { "uuid": "0191c7b3-2e3f-7a4b-9c5d-6e7f8a9b0c16", "name": "Paul Müller" }
    ],
    "sharedOffers": [],
    "debtor": {
      "uuid": "0191c7b4-5a6b-7c8d-9e0f-1a2b3c4d5e09",
      "balance": 0
    },
    "piiMasked": false
  }
]

GET/accounts/{uuid}

Retrieve an account

Returns one account.

Request

GET·/accounts/{uuid}

curl https://ferienpass-musterstadt.de/api/accounts/0191c7b2-4d5e-7f60-8a1b-2c3d4e5f6a05 \
  -H "Authorization: Bearer $FEPLI_TOKEN"

POST/accounts

Create an account

Creates an account. It has no password: the person signs in with a link sent by e-mail, or sets a password later. Without roles, the account is a family account (ROLE_MEMBER).

Only super admins can create admin accounts.

Required attributes

Name
email
Type
string
Description
A valid e-mail address, not used by another account.

Optional attributes

Name
firstname, lastname
Type
string
Description
Up to 255 characters each.
Name
phone, mobile
Type
string
Description
Up to 64 characters each.
Name
locale
Type
string
Description
The language, such as de or en.
Name
roles
Type
string[]
Description
Any of member, host, admin, super_admin, participants_admin, payments_admin, cms_admin, or the ROLE_… names. If none of member, host or admin is given, member is added.
Name
hosts
Type
string[]
Description
Organisers (UUIDs or aliases) the account is a team member of. Adds ROLE_HOST.
Name
address
Type
object
Description
street, postalCode, city and country (two letters, defaults to de).
Name
disabled
Type
boolean
Description
Create the account suspended.
Name
notifyComments
Type
boolean
Description
Whether the person gets notified about new comments.

Request

POST·/accounts

curl -X POST https://ferienpass-musterstadt.de/api/accounts \
  -H "Authorization: Bearer $FEPLI_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "m.schneider@kunstschule-musterstadt.de",
    "firstname": "Mira",
    "lastname": "Schneider",
    "hosts": ["kunstschule-musterstadt"]
  }'

Response (201 Created, excerpt)

{
  "uuid": "0193c9e4-8f9a-7b0c-9d1e-2f3a4b5c6d21",
  "email": "m.schneider@kunstschule-musterstadt.de",
  "name": "Mira Schneider",
  "roles": ["ROLE_MEMBER", "ROLE_HOST"],
  "hasPassword": false,
  "hosts": [
    {
      "uuid": "0193c9d1-2e3f-7a4b-8c5d-6e7f8a9b0c18",
      "name": "Kunstschule Musterstadt",
      "alias": "kunstschule-musterstadt"
    }
  ],
  "…": "…"
}

PATCH/accounts/{uuid}

Update an account

Changes an account. The attributes are the same as for creating an account; send only what you want to change.

"disabled": true suspends the account: the person can't sign in any more. false lifts the suspension. This has nothing to do with a blocked e-mail address; for that, see Unblock an e-mail address.
roles replaces the account's roles. Granting admin or super_admin needs a super admin; the other admin roles can be granted by any admin.
hosts replaces the account's memberships. To add or remove a single one, use Add a team member and Remove a team member.
address replaces the first postal address as a whole: send all its fields. null removes it.

Changing, deleting or pseudonymising an admin's account needs a super admin; admins may always change their own. Accounts whose personal data is masked for you can't be changed.

Request

PATCH·/accounts/{uuid}

curl -X PATCH https://ferienpass-musterstadt.de/api/accounts/0191c7b2-4d5e-7f60-8a1b-2c3d4e5f6a05 \
  -H "Authorization: Bearer $FEPLI_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"mobile": "0171 7654321"}'

DELETE/accounts/{uuid}

Delete an account

Deletes an account together with its participants and their applications. Responds with 204 No Content.

If a paid receipt refers to one of the family's applications, the account can't be deleted (409): the receipt has to stay complete for bookkeeping. Pseudonymise the account instead.

Request

DELETE·/accounts/{uuid}

curl -X DELETE https://ferienpass-musterstadt.de/api/accounts/0191c7b2-4d5e-7f60-8a1b-2c3d4e5f6a05 \
  -H "Authorization: Bearer $FEPLI_TOKEN"

POST/accounts/{uuid}/pseudonymize

Pseudonymise an account

Erases the personal data of the account and its participants. The account and its participants are deleted; their applications are kept under a random pseudonym, and receipts keep their billing address, as bookkeeping requires. Use it when a family asks for their data to be deleted and a paid receipt prevents deleting the account.

The request has no body, and the response is 204 No Content. Afterwards, the account is a 404.

Request

POST·/accounts/{uuid}/pseudonymize

curl -X POST https://ferienpass-musterstadt.de/api/accounts/0191c7b2-4d5e-7f60-8a1b-2c3d4e5f6a05/pseudonymize \
  -H "Authorization: Bearer $FEPLI_TOKEN"

POST/accounts/{uuid}/unblock-email

Unblock an e-mail address

Asks for e-mails to the account's address to be delivered again after they bounced, as E-Mail freischalten does in the admin. The request has no body.

The block is kept by the mail provider; fepli only mirrors it. fepli asks the provider to lift it, and blockedEmail turns false once the provider has done so. The response is therefore 202 Accepted with the account, which may still show "blockedEmail": true: retrieve the account again a moment later. If the provider refuses, the block stays and so does blockedEmail.

Unblock an address only once the cause is gone, for example a full mailbox that was emptied: an address that still doesn't work bounces again.

An address that isn't blocked is a 409. This endpoint doesn't touch signing in: to stop a person from signing in, suspend the account with "disabled": true (Update an account).

Request

POST·/accounts/{uuid}/unblock-email

curl -X POST https://ferienpass-musterstadt.de/api/accounts/0191c7b2-4d5e-7f60-8a1b-2c3d4e5f6a05/unblock-email \
  -H "Authorization: Bearer $FEPLI_TOKEN"

Response (202 Accepted, excerpt)

{
  "uuid": "0191c7b2-4d5e-7f60-8a1b-2c3d4e5f6a05",
  "email": "familie.mueller@example.org",
  "blockedEmail": true,
  "…": "…"
}