title: Clarification on REST APIs around user management in an account
body: <p>I recently created a docusign developer account and integrator key and was playing with docusign REST APIs and had some questions</p>
  
  <ol>
  <li><p>I can retrieve full list of users under my account by using following REST call.
  <code>https://demo.docusign.net/restapi/v2/accounts/&lt;accountid&gt;/users?additional_info=true</code></p>
  
  <p>However if I try and retrieve a specific user (other than the one I am passing in my X-Docusign-authentication) header i get http 400 error with message that the "Invalid UserId. UserId specified in request uri does not match authenticated user"</p>
  
  <p><code>https://demo.docusign.net/restapi/v2/accounts/&lt;accountid&gt;/users/0d51a699-b17a-48b7-95b6-1e9e9806deb6</code>         </p>
  
  <p>In both cases i am sending the following header.</p>
  
  <p><code>X-DocuSign-Authentication: &lt;DocuSignCredentials&gt;&lt;Username&gt;{0}&lt;/Username&gt;&lt;Password&gt;{1}&lt;/Password&gt;&lt;IntegratorKey&gt;{2}&lt;/IntegratorKey&gt;&lt;/DocuSignCredentials&gt;</code>   </p>
  
  <p>I am surprised that while I can read all users fine, I cannot just read one specific user. Surely it doesn't seem like this is security thing since I can read the user via one API but not the other using the same auth token.</p>
  
  <p>What am i missing?</p>
  
  <p>I guess I can go the route of SOBO (Send on behalf of functionality), but I wanted to confirm if above behavior is expected.</p></li>
  </ol>
  
  <p><em><strong>Update#1</em></strong></p>
  
  <p>: I went the SOBO <a href="http://www.docusign.com/p/RESTAPIGuide/Content/OAuth2/Acting%20As%20Other%20Account%20Users.htm" rel="nofollow">approach</a> and now i get a different error (USER_NOT_ACCOUNT_ADMIN) as shown below</p>
  
  <pre><code>GET /restapi/v2/accounts/{accountid}/users/0fe29a55-5564-42a9-b09d-cbe699db13dd HTTP/1.1
  Authorization: bearer {token for authenticating user}
  X-DocuSign-Act-As-User: {operating user's email}
  Accept: application/json
  Host: demo.docusign.net
  Connection: Keep-Alive
  
  HTTP/1.1 401 Unauthorized
  Cache-Control: no-cache
  Content-Length: 100
  Content-Type: application/json; charset=utf-8
  Date: Thu, 17 Oct 2013 21:18:32 GMT
  Strict-Transport-Security: max-age=7776000; includeSubDomains
  
  {
    "errorCode": "USER_NOT_ACCOUNT_ADMIN",
    "message": "User is not an account administrator."
  }
  </code></pre>
  
  <p>I also tried the second SOBO approach of getting a oauth token for the operating user but got back http 400 error with below message</p>
  
  <pre><code>{
    "error": "invalid_request",
    "error_description": "An OAuth2 error occurred."
  }
  </code></pre>
  
  <p>So while i can get an oauth token for the autheitcating user, i am not able obtain oauth token for the operating user or act on their behalf.</p>
  
  <p>I have made sure that authenticating user is "Account Administrator" and has both "apiAccountWideAccess" and "•allowSendOnBehalfOf" set to true. The only thing set to "false" is "canSendAPIRequests". My account id in sandbox environment is "601565a7-e9c7-463b-9d7c-622aed905ea8" Any ideas?</p>
  
  <p><em><strong>Update#2</em></strong></p>
  
  <p>Instead of generating oauth tokens on behalf of both authenticating user and operating user, i tried passing below header and i can finally get another user's profile and update another user's profile.</p>
  
  <pre><code>X-DocuSign-Authentication: &lt;DocuSignCredentials&gt;&lt;SendOnBehalfOf&gt;{operating userid}&lt;/SendOnBehalfOf&gt;&lt;Username&gt;{authenticating userid}&lt;/Username&gt;&lt;Password&gt;{authenticating user's password}&lt;/Password&gt;&lt;IntegratorKey&gt;{developer's integrator key}&lt;/IntegratorKey&gt;&lt;/DocuSignCredentials&gt;
  </code></pre>
  
  <p>Great! 
  So here is status of what works and what doesn't.</p>
  
  <p><em><strong>Works with no SOBO header anywhere</em></strong></p>
  
  <pre><code>GET /restapi/v2/accounts/357938/users?additional_info=true // Read all users  
  GET /restapi/v2/accounts/357938/users?email=someshchandraatwork@gmail.com&amp;additional_info=true // Read single user by email
  POST /restapi/v2/accounts/357938/users // Add users
  DELETE /restapi/v2/accounts/357938/users // Close users    
  </code></pre>
  
  <p>*<strong><em>Works with SOBO in X-DocuSign-Authentication header</em></strong></p>
  
  <pre><code>PUT /restapi/v2/accounts/357938/users/74a021e1-3090-4843-b9ab-cceb7cd119f4/profile // Update user's profile
  GET /restapi/v2/accounts/357938/users/74a021e1-3090-4843-b9ab-cceb7cd119f4/profile // Read user's profile
  </code></pre>
  
  <p><em><strong></em> Still doesn't work with or without SOBO**</strong></p>
  
  <pre><code>GET /restapi/v2/accounts/357938/users/74a021e1-3090-4843-b9ab-cceb7cd119f4/settings 
  GET /restapi/v2/accounts/357938/users/74a021e1-3090-4843-b9ab-cceb7cd119f4
  </code></pre>
  
  <p>In both not working cases i get following error</p>
  
  <ul>
  <li>Without SOBO i get error that userid doesn't match autheitcating user. </li>
  <li>With SOBO i get error than user is not an account admin</li>
  </ul>
  
  <p>I would very much appreciate any help in resolving the not working cases. I can provide more detaisl as needed.</p>
  
  <ol>
  <li><p>Secondly I want to implement a scenario where I can deactivate a user in an account so they can no longer log into docusign. And subsequently I would like to enable that user back again with same permission that they had before they were disabled.</p>
  
  <p>I see that user has a "userStatus" field and was wondering if I can use that to de-activate the user and then re-activate if needed. If this is supported then what value would correspond to deactivating the user?</p>
  
  <p>The other thing I note is that on DELETE a user, the user is only soft-deleted since I can still query the user with the status "CLOSED". That would solve my "deactivate" problem. However I was not sure if there is a way to reactivate them back again after the user has been "closed"?</p></li>
  </ol>