How to manage end-user accounts

Before you start

Use this guide when an investigation requires an operational change to an existing end-user account, such as blocking access, unblocking access, or linking the account to a CRM record.

A valid access token (see How to authenticate)
Your tenant_slug, the tenant DNS slug used in the API host and path (for example, demo-retail)
The account's website_account_id
Required scopes: read:enduseraccount to inspect the account and update:enduseraccount to update it

Inspect the account

Fetch the current account state before changing it:

curl 'https://api.YOUR_TENANT_SLUG.urbanfox.io/v2/YOUR_TENANT_SLUG/enduseraccounts/WEBSITE_ACCOUNT_ID' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Response:

{
  "data": {
    "website_account_id": "account-abc123",
    "is_blocked": false,
    "is_fraudulent": false,
    "is_quarantined": false,
    "last_session_updated_on": "2024-01-15T10:30:00Z"
  }
}

Check the is_blocked value before you update it.

Block an account

After confirming the account should no longer have access, set is_blocked to true:

curl -X PUT 'https://api.YOUR_TENANT_SLUG.urbanfox.io/v2/YOUR_TENANT_SLUG/enduseraccounts/WEBSITE_ACCOUNT_ID' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
    "is_blocked": true
  }'

The response returns the updated account object. Confirm that data.is_blocked is true.

Unblock an account

After confirming the account should have access again, set is_blocked to false:

curl -X PUT 'https://api.YOUR_TENANT_SLUG.urbanfox.io/v2/YOUR_TENANT_SLUG/enduseraccounts/WEBSITE_ACCOUNT_ID' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
    "is_blocked": false
  }'

The response returns the updated account object. Confirm that data.is_blocked is false.

Link to a CRM record

Associate the account with an external CRM identifier:

curl -X PUT 'https://api.YOUR_TENANT_SLUG.urbanfox.io/v2/YOUR_TENANT_SLUG/enduseraccounts/WEBSITE_ACCOUNT_ID' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
    "crm_account_id": "crm-new-id-789"
  }'

The response returns the updated account object. Confirm that data.crm_account_id matches the CRM identifier you sent.

Verify the account state

Fetch the account again:

curl 'https://api.YOUR_TENANT_SLUG.urbanfox.io/v2/YOUR_TENANT_SLUG/enduseraccounts/WEBSITE_ACCOUNT_ID' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Use the returned is_blocked and crm_account_id values as the source of truth for the account state.

If it's not working

Symptom	Action
`401` response	Token expired; request a fresh one
`403` on get	Confirm your token has `read:enduseraccount` scope
`403` on update	Confirm your token has `update:enduseraccount` scope
`404` on get/update	Verify the `website_account_id` exists for your tenant
`422` validation error	Check the request body; boolean fields must be `true` or `false`, not strings