Users¶

A user is a TEBHOS account. Other accounts see the partial user object, and the owner sees the user object. Changes to your own account are covered on Current user.

All paths on this page are relative to https://tebhos.com/api/v1.

Authentication on user routes¶

See Authentication for how tokens are obtained.

Partial user object¶

The public account representation. It is what Get user returns and what other resources embed as author, user, and similar fields.

Structure¶

Example¶

{
  "id": "1501314428688998182",
  "username": "aria",
  "discriminator": "0",
  "global_name": "Aria",
  "avatar": "a_2f1c9d7be4a350c8e0f1",
  "avatar_color": 5793266,
  "flags": 0
}

Deleted and system accounts¶

An account whose deletion has completed is serialised with username DeletedUser, discriminator 0000, global name Deleted User, null avatar and avatar_color, and flags of 0 in the user object and in embedded author objects built by the API. An account that is only scheduled for deletion keeps its normal representation during the grace period.

The built-in system account has ID 0, username TEBHOS, discriminator 0000, bot and system set to true, and the STAFF flag. It sends TEBHOS system messages.

Image hashes¶

avatar and banner hold a content hash, not a URL. A hash that starts with a_ belongs to an animated image. Build the URL from the hash:

https://tebhos.com/api/v1/avatars/{user_id}/{avatar_hash}.webp
https://tebhos.com/api/v1/banners/{user_id}/{banner_hash}.webp

See Media proxy routes for sizes and formats. An account without an avatar has avatar: null; clients render a default avatar derived from the user ID.

Animated avatars and every profile banner are TEBHOS Pro features. In the user object the a_ prefix is removed from the avatar hash, and banner is null, while the account has no active premium (bots are always entitled).

Public user flags¶

flags holds the publicly visible subset of the account's stored flags. STAFF is removed while the account also has the hidden-staff flag.

Reply mention preferences¶

The account-wide default applied when someone replies to one of this account's messages. mention_flags is one of the values below and is omitted from a serialised user while the stored value is 0. Set it with Modify current user.

User object¶

The private representation of the current account, returned by Get current user and by the operations that change the account. It extends the partial user object.

Structure¶

Premium state is computed as follows: an account is premium when it is a bot, when a staff override is set, or when it has a paid premium type whose premium_until has not passed. After premium_until, entitlements stay active until premium_grace_ends_at, or for 3 days when that value is null. premium_perks_disabled switches entitlements off regardless.

Example¶

{
  "id": "1501314428688998182",
  "username": "aria",
  "discriminator": "0000",
  "global_name": "Aria",
  "avatar": "2f1c9d7be4a350c8e0f1",
  "avatar_color": 5793266,
  "flags": 0,
  "is_staff": false,
  "acls": [],
  "traits": [],
  "email": "[email protected]",
  "email_bounced": false,
  "phone": null,
  "has_verified_phone": false,
  "bio": "Hello!",
  "pronouns": null,
  "accent_color": null,
  "timezone": "Europe/Istanbul",
  "timezone_privacy_flags": 1,
  "banner": null,
  "banner_color": null,
  "mfa_enabled": true,
  "authenticator_types": [0],
  "verified": true,
  "premium_type": 0,
  "premium_since": null,
  "premium_until": null,
  "premium_will_cancel": false,
  "premium_billing_cycle": null,
  "premium_lifetime_sequence": null,
  "premium_grace_ends_at": null,
  "premium_discriminator": false,
  "premium_badge_hidden": false,
  "premium_badge_masked": false,
  "premium_badge_timestamp_hidden": false,
  "premium_badge_sequence_hidden": false,
  "premium_purchase_disabled": false,
  "premium_enabled_override": false,
  "premium_perks_disabled": false,
  "password_last_changed_at": "2026-08-01T10:15:00.000Z",
  "last_voice_activity_sharing_change_at": null,
  "required_actions": [],
  "nsfw_allowed": false,
  "has_dismissed_premium_onboarding": false,
  "has_ever_purchased": false,
  "has_unread_gift_inventory": false,
  "unread_gift_inventory_count": 0,
  "terms_agreed_at": "2026-07-20T08:00:00.000Z",
  "privacy_agreed_at": "2026-07-20T08:00:00.000Z",
  "pending_bulk_message_deletion": null
}

Pending bulk message deletion object¶

Present while a deletion of every message the account has sent is scheduled (see Content).

The counts are computed when the deletion is scheduled.

Authenticator types¶

authenticator_types only ever contains these two values. Registering a passkey does not add WEBAUTHN on TEBHOS, so today the array reports only TOTP, and mfa_enabled reflects TOTP only. Passkeys still count as a second factor for sudo verification. See MFA.

Premium types¶

See Premium for purchasing, which TEBHOS handles through Polar.

Profile field privacy flags¶

Controls who can see an individual profile field (the timezone and each connection). A value of 0 hides the field from everyone, including the owner's own profile card.

User settings object¶

The complete account-wide settings record. Get current user settings and Modify current user settings return it, and the USER_SETTINGS_UPDATE Gateway event carries it. Every field below is always present. A field that was never written is returned with its initial value.

Structure¶

Custom status object¶

The text and emoji shown under the account's name. It is stored with the profile, so Modify current user settings and the custom-status fields of Modify current user write the same value.

An expired status is returned as null.

{
  "text": "shipping",
  "emoji_id": null,
  "emoji_name": "🚀",
  "emoji_animated": false,
  "expires_at": "2026-09-24T18:00:00+00:00"
}

Guild folder object¶

One entry of the guild sidebar layout.

Leaving or being removed from a guild removes its ID from every folder and drops every non-uncategorised folder that becomes empty. Joining a guild does not change the layout.

{
  "id": -1,
  "name": null,
  "color": 0,
  "flags": 0,
  "icon": "folder",
  "guild_ids": ["1501314428688998182", "1501314428688998183"]
}

Guild folder flags¶

Guild folder icons¶

Sticker animation settings¶

Spoiler rendering settings¶

Time format settings¶

Sensitive media filters¶

All three values are accepted for every filter field, including sensitive_content_guild_filter.

Profile privacy levels¶

Controls who sees the full profile. Friends always see it, and so does the account itself; bot profiles are never restricted.

A restricted viewer still receives the profile, but with bio, pronouns, the premium badge, timezone_offset and connected_accounts removed and profile_limited: true. See Get user profile and Get user profile card. Get profile removes bio and pronouns for a restricted viewer.

Friend source flags¶

Who may send the account a friend request.

Incoming call flags¶

Who may start a DM call with the account. SILENT_EVERYONE makes permitted calls arrive without ringing.

When stored, a value containing FRIENDS_ONLY becomes FRIENDS_ONLY alone, and otherwise a value containing NOBODY becomes NOBODY alone; SILENT_EVERYONE is kept in both cases.

Group DM add permission flags¶

Who may add the account to a group DM.

When stored, FRIENDS_ONLY wins over NOBODY, which wins over EVERYONE; the winning flag is stored alone.

User profile object¶

The record returned by Get user profile.

Profile object¶

The profile record returned by Get profile. It combines core account fields with TEBHOS profile customisation.

Profile card object¶

The richer record returned by Get user profile card. When the request names a guild, top-level image_url, bio, pronouns, accent_color and banner fields hold the member's effective values (their per-guild profile overrides the global one).

Mutual server object¶

Mutual friend object¶

Role summary object¶

Member profile object¶

Profile connection object¶

Get user¶

GET /users/{user_id}

Returns the partial user object of any account. No relationship with the target is required. User sessions only.

Path parameters¶

Response¶

The response comes from the TEBHOS user service. It returns the stored avatar hash unchanged (including the a_ prefix) and does not substitute the deleted-account placeholder.

Rate limit¶

100 requests per 10 seconds per client and target, bucket user:read.

curl https://tebhos.com/api/v1/users/1501314428688998182 \
  -H "Authorization: Bearer $TEBHOS_TOKEN"

Get user profile¶

GET /users/{user_id}/profile

Returns the user profile object. Accepts user sessions and bot tokens. user_id may be @me.

Query parameters¶

Privacy¶

• Access. Unless the target is a bot or yourself, you must be friends, have a pending friend request in either direction, share a guild, or share a group direct message with the target. Otherwise the request fails with 403 MISSING_ACCESS.
• Restriction. The target's profile privacy level decides whether you see the full profile; a restricted profile carries profile_limited: true.
• Fields. timezone_offset and each connection are filtered by their profile field privacy flags.

Response¶

Rate limit¶

100 requests per 10 seconds per caller and target, bucket user:profile.

curl "https://tebhos.com/api/v1/users/1501314428688998182/profile?with_mutual_guilds=true" \
  -H "Authorization: Bot $TEBHOS_BOT_TOKEN"

Get profile¶

GET /profile/{user_id}

Returns the TEBHOS profile object of any account. Accepts user sessions and bot tokens. No relationship with the target is required. When the target's profile privacy level restricts you, bio and pronouns are null; other fields are always returned. Use Get user profile for the full privacy rules.

Response¶

Rate limit¶

100 requests per 10 seconds per caller and target, bucket user:profile.

Get user profile card¶

GET /profile/{user_id}/card

Returns the profile card object, which adds mutual guilds and friends, your relationship, note and nickname, visible connections, the timezone offset, and optional per-guild member data. Accepts user sessions and bot tokens.

Query parameters¶

Behaviour¶

• No relationship with the target is required to read the card.
• Unless you are reading your own card, the target is a bot, or you are friends, the target's profile privacy level decides whether the card is restricted. A restricted card nulls bio, pronouns and premium_since (in member_profile too), sets timezone_offset to null, empties connected_accounts, and adds profile_limited: true.
• timezone_offset and each connection are also filtered by their own profile field privacy flags.

Response¶

curl "https://tebhos.com/api/v1/profile/1501314428688998182/card?server_id=1501314428688998100" \
  -H "Authorization: Bearer $TEBHOS_TOKEN"

Check user tag¶

GET /users/check-tag

Reports whether a username and discriminator pair is already taken. User sessions only.

Query parameters¶

Your own current tag reports false. The route performs no format validation; see Modify current user for the username rules applied when you actually change it.

Response body¶

Rate limit¶

60 requests per 10 seconds per user, bucket user:check_tag.

{ "taken": false }