User

Create a user, keyed by your own id for it: 1 to 255 printable ASCII characters, without spaces or /, other than all and none. An id another live user has raises noclick.Conflict (its existing_id is that id). timezone is where they are, as an IANA name ("America/New_York"): every turn of an agent acting for them starts with the date and time there, unless the agent has a timezone of its own.

A lazy reference to the user with your id. With create_if_missing=True your code is the definition: it's created with the given fields on first use, and an existing user whose name, email, phone, spend_cap_usd_per_month, metadata or timezone differ is updated to match. A field you leave out is never changed, and None clears one, as in update().

Load a user by your id now; an unknown id raises noclick.NotFound.

Your users, newest first (or the first limit). q is a case-insensitive prefix of the id, name or email; status active or suspended; spending "paused" or "active", to find the users whose spending you've paused (say, to check them against your billing after an outage).

One page of users; pass next_cursor back as cursor. Takes list's filters.

Change fields (None clears one); a field you leave out is unchanged. A new id renames the user: everything it owns follows, and an id another user has raises noclick.Conflict. A user acting for themselves may change their own timezone, their session included (it may change nothing else).

Stop all activity for this user: every call made for it then fails with noclick.PermissionDenied, and its history stays readable.

Stop everything that costs money for this user until resume_spending(), and say what they can do about it. Call it from your billing when they run out (say, at a balance alert) or fall behind. message is what NoClick tells them, in your words, up to 500 characters; action is a (label, url) pair, your checkout or billing page, up to 40 characters and an https URL. Both may use {{user.id}}, {{user.name}}, {{user.email}} and {{user.metadata.<key>}}, filled in now; a field this user lacks raises noclick.InvalidRequest. Without message, the default you set in the console (Settings, Paused spending) is used, and with no default either it raises noclick.InvalidRequest; without action, the default's button.

While paused, a call your code makes for them raises noclick.SpendingPaused; a message they send an agent (an email to its inbox, a post in their channel) is answered once per conversation with message and action and held, up to 24 hours, to run when you resume; a call to a number they reach hears message; schedules, webhooks and app events for their agents are skipped. Work under way finishes the step it's on. What they already have keeps running and billing: pausing isn't cancelling. Reads still work. Pausing a paused user changes its message and action and keeps since and what's held. Only a key acting for your whole account can pause or resume: never the user's own session.

Let this user spend again, say once your billing has their payment. What was held for them runs now, in the order it arrived: each message as the turn it would have been, with when it arrived, so the agent knows it waited. Resuming a user who isn't paused changes nothing.

Mark the user deleted, which frees its id for reuse. Nothing acts for them afterwards (invite-only beta): their connections' grants are revoked at each provider, their agents' triggers stop, their inboxes stop receiving mail and their phone numbers are released. What's kept is the record: operations, tool calls, conversations, usage and spend stay readable with user_filter, and their databases, buckets, repos and files stay until you delete them. export=True packs up everything the user holds first, as export() does, and deletes the user once the export is stored; nothing is deleted if the export fails or is canceled. Only a call acting for the account deletes users.

Pack up everything the user holds, in forms that work without NoClick: their own agents' definitions as JSON, their conversations with any agent as JSON Lines transcripts, what agents remember about them as Markdown, their databases as SQL, their buckets' and volumes' files, their dicts and queues as JSON Lines, their repos as git bundles, their apps' settings, connections and secrets by name only (never a token or a value), and each phone number and domain with the call that moves it (transfer_out). The user keeps working; one export of a user runs at a time (another raises noclick.Conflict naming it).

Text a verification code to the user's phone (or phone=, which becomes its number); confirm it with check_phone(code).

Check the code the user received. A wrong code raises InvalidRequest, an expired one Expired, and too many tries RateLimited.

Mint a short-lived token that acts only as this user, with scopes (a subset of your key's: agents, humans, credentials:request, credentials:use, channels, inbox, ai). ttl_s is at most 24h. Hand session.token to your frontend, or use noclick.Client.for_session(session). Revoking the minting key revokes its sessions.