> ## Documentation Index
> Fetch the complete documentation index at: https://docs-dev-ia-user-profiles.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Auth0 User Profile Attribute Schema

> View a reference for Auth0 user profile attributes, including validation requirements and support for features like search and upsert.

Auth0's normalized user profile consists of the following attributes. Each attribute indicates whether it is supported for [search](/docs/manage-users/user-search), [update](https://auth0.com/docs/api/management/guides/users/update-root-attributes-users), [import](/docs/manage-users/user-migration/bulk-user-imports), [upsert](/docs/manage-users/user-migration/bulk-user-imports#request-bulk-import), and [export](/docs/manage-users/user-migration/bulk-user-exports).

## User profile attributes

For Auth0 database connections, all characters are converted to lowercase when saved to the user profile. When not using the Auth0 user store (for example, custom database connections with import mode off, or other connection types), the email is retained as-is and not converted to lowercase.

<ResponseField name="app_metadata" type="object" post={["search", "update", "import", "upsert", "export"]}>
  Custom fields that store info about a user that influences the user's access, such as support plan, security roles (if not using the Authorization Core feature set), or access control groups. To learn more, read [Metadata Overview](/docs/manage-users/user-accounts/metadata).
</ResponseField>

<ResponseField name="blocked" type="boolean" post={["search", "update", "import", "export"]}>
  Indicates whether the user has been blocked. Importing enables subscribers to ensure that users remain blocked when migrating to Auth0.
</ResponseField>

<ResponseField name="blocked_for" type="object[]" post={[]}>
  IP addresses that have been blocked under suspicion of a bruteforce attack.
</ResponseField>

<ResponseField name="created_at" type="date time" post={["search", "export"]}>
  Timestamp indicating when the user profile was first created.
</ResponseField>

<ResponseField name="email" type="string" post={["search", "update", "import", "export"]}>
  (unique) The user's email address.

  The maximum length is 64 characters for the user/local part and 256 characters for the domain part. This value is validated by the [JSON validation schema](https://json-schema.org/understanding-json-schema/reference/type#email-addresses).
</ResponseField>

<ResponseField name="email_verified" type="boolean" post={["search", "update", "import", "upsert", "export"]}>
  Indicates whether the user has verified their email address.
</ResponseField>

<ResponseField name="family_name" type="string" post={["search", "update", "import", "upsert", "export"]}>
  The user's family name.

  The length can be 1-150 characters and it can contain any UTF-8 character.
</ResponseField>

<ResponseField name="given_name" type="string" post={["search", "update", "import", "upsert", "export"]}>
  The user's given name.

  The length can be 1-150 characters and it can contain any UTF-8 character.
</ResponseField>

<ResponseField name="guardian_authenticators" type="object[]" post={[]}>
  Detailed information about the guardian backup authorization methods the user has set up, including SMS and Recovery Codes.
</ResponseField>

<ResponseField name="identities" type="object[]" post={["search", "export"]}>
  Contains info retrieved from the identity provider with which the user originally authenticates. Users may also [link their profile to multiple identity providers](/docs/manage-users/user-accounts/user-account-linking); those identities will then also appear in this array. The contents of an individual identity provider object varies by provider, but it will typically include the following:

  * `connection` (text): Name of the Auth0 connection used to authenticate the user.
  * `isSocial` (boolean): Whether the connection is a social one.
  * `provider` (text): Name of the entity that is authenticating the user, such as Facebook, Google, SAML, or your own provider.
  * `user_id` (text): User's unique identifier for this connection/provider.
  * `profileData` (object): User info associated with the connection. When profiles are linked, it is populated with the associated user info for secondary accounts.

  In some cases, it will also include an API Access Token to be used with the provider.
</ResponseField>

<ResponseField name="last_ip" type="string" post={["search", "export"]}>
  IP address associated with the user's last login.
</ResponseField>

<ResponseField name="last_login" type="date time" post={["search", "export"]}>
  Timestamp indicating when the user last logged in. If a user is blocked and logs in, the blocked session updates `last_login`. If you are using this property from inside a [Rule](/docs/customize/rules) using the `user<` object, its value will be associated with the login that triggered the rule; this is because rules execute after login.
</ResponseField>

<ResponseField name="last_password_reset" type="date time" post={["export"]}>
  Timestamp indicating the last time the user's password was reset/changed. At user creation, this field does not exist. This property is only available for Database connections.
</ResponseField>

<ResponseField name="logins_count" type="integer" post={["search", "export"]}>
  Number of times the user has logged in. If a user is blocked and logs in, the blocked session is counted in `logins_count`.
</ResponseField>

<ResponseField name="multifactor" type="string[]" post={["export"]}>
  List of multi-factor providers with which the user is enrolled.
</ResponseField>

<ResponseField name="multifactor_last_modified" type="date time" post={["export"]}>
  Date and time of the last update to a user's multifactor authentication.
</ResponseField>

<ResponseField name="name" type="string" post={["search", "update", "import", "upsert", "export"]}>
  The user's full name.

  The length can be 1-150 characters and it can contain any UTF-8 character.
</ResponseField>

<ResponseField name="nickname" type="string" post={["search", "update", "import", "upsert", "export"]}>
  The user's nickname.

  The length can be 1-350 characters and it can contain any UTF-8 character.
</ResponseField>

<ResponseField name="phone_number" type="string" post={["search", "update", "export"]}>
  The user's phone number. Only valid for users with SMS connections.

  Phone numbers must be in E.164 format and are validated against the regular expression `^\+[0-9]{1,15}$`.
</ResponseField>

<ResponseField name="phone_verified" type="boolean" post={["search", "update", "export"]}>
  Indicates whether the user has been verified their phone number. Only valid for users with SMS connections.
</ResponseField>

<ResponseField name="picture" type="string" post={["update", "import", "upsert", "export"]}>
  URL pointing to [the user's profile picture](/docs/manage-users/user-accounts/change-user-picture).
</ResponseField>

<ResponseField name="tenant" type="string" post={[]}>
  Name of the tenant being used.
</ResponseField>

<ResponseField name="updated_at" type="date time" post={["search", "export"]}>
  Timestamp indicating when the user's profile was last updated/modified. Changes to `last_login` are considered updates, so most of the time, `updated_at` will match `last_login`.
</ResponseField>

<ResponseField name="user_id" type="string" post={["search", "import", "export"]}>
  (unique) The user's identifier. Importing allows user records to be synchronized across multiple systems without using mapping tables.
</ResponseField>

<ResponseField name="user_metadata" type="object" post={["search", "update", "import", "upsert", "export"]}>
  Custom fields that store info about a user that does not impact what they can or cannot access, such as work address, home address, or user preferences. To learn more, read [Metadata Overview](/docs/manage-users/user-accounts/metadata).
</ResponseField>

<ResponseField name="username" type="string" post={["search", "update", "import", "export"]}>
  (unique) The user's username.

  The default allowed length for usernames is between 1 and 15 characters up to a maximum length of 128 characters. The username field accepts alphanumeric characters without accent marks, automatically converted to lowercase, and the following special characters:

  * at sign, `@`, but email addresses are not allowed
  * backtick, <code>\`</code>
  * caret, `^`
  * dollar sign, `$`
  * exclamation mark, `!`
  * minus, `-`
  * number sign, `#`
  * period, `.`
  * plus, `+`
  * single quote, `'`
  * tilde, `~`
  * underscore, `_`

  No other characters/symbols are allowed, and Auth0 does not validate or sanitize custom database inputs.
</ResponseField>

## Password validation

Auth0 accepts a specific validation schema for passwords:

* `password`: The minimum password length you can set is 1 byte, while the maximum is 72 bytes. Passwords support ASCII characters in the range of 33-126.

* `password_hash` (text): Hashed password for the user's connection. When users are created, [Auth0 uses bcrypt](https://auth0.com/blog/hashing-in-action-understanding-bcrypt/) to secure the password. Importing compatible hashed passwords allows users to retain their passwords, thereby providing a smoother experience. Compatible passwords should be hashed using bcrypt `{"$2a$"}` or `{"$2b$"}` and have 10 `saltRounds`. You can provide this field only when the user is first imported; you cannot update it later.

* `custom_password_hash` (object): Hashed password for the user's connection when created using an alternate algorithm. Used in place of the `password_hash` field. During the bulk import process, you can update the `custom_password_hash` if the user did not login using the initially imported `custom_password_hash.`

## User profile examples

<AccordionGroup>
  <Accordion title="Google user profile example">
    This is a sample user profile from a user that logged in through Google:

    ```json theme={null}
    {
      "email": "johnfoo@gmail.com",
      "email_verified": true,
      "family_name": "Foo",
      "gender": "male",
      "given_name": "John",
      "identities": [
        {
          "provider": "google-oauth2",
          "user_id": "103547991597142817347",
          "connection": "google-oauth2",
          "isSocial": true
        }
      ],
      "locale": "en",
      "name": "John Foo",
      "nickname": "FooJon",
      "picture": "https://lh4.googleusercontent.com/-OdsbOXom9qE/AAAAAAAAAAI/AAAAAAAAADU/_j8SzYTOJ4I/photo.jpg",
      "user_id": "google-oauth2|103547991597142817347"
    }
    ```
  </Accordion>

  <Accordion title="Microsoft Account user profile example">
    This is a sample profile from Microsoft Account:

    ```json lines theme={null}
    {
      "email": "bobdoe@outlook.com",
      "email_verified": true,
      "emails": [
        "bobdoe@outlook.com",
        "bobdoe@outlook.com"
      ],
      "family_name": "Doe",
      "given_name": "Bob",
      "identities": [
        {
          "provider": "windowslive",
          "user_id": "4cf0a30169d55031",
          "connection": "windowslive",
          "isSocial": true
        }
      ],
      "locale": "en_US",
      "name": "Bob Doe",
      "nickname": "doebob@outlook.com",
      "picture": "https://secure.gravatar.com/avatar/c89b2bb92df91508e14172097a5e17da?s=480&r=pg&d=https%3A%2F%2Fssl.gstatic.com%2Fs2%2Fprofiles%2Fimages%2Fsilhouette80.png",
      "user_id": "windowslive|4cf0a30169d55031"
    }
    ```
  </Accordion>

  <Accordion title="Office 365 user profile example">
    This is a sample profile from Office 365 (Microsoft Azure Active Directory):

    ```json theme={null}
    {
      "email": "jeff@foo.onmicrosoft.com",
      "family_name": "Jeff",
      "given_name": "Beth",
      "identities": [
        {
          "user_id": "10030000838D23AF@MicrosoftOnline.com",
          "provider": "office365",
          "connection": "foo-onmicrosoft",
          "isSocial": false
        }
      ],
      "name": "Jeff Beth",
      "nickname": "jeff@auth0.onmicrosoft.com",
      "picture": "https://secure.gravatar.com/avatar/a7f86ddd090d5a4cb833b97baab2aca1?s=480&r=pg&d=https%3A%2F%2Fssl.gstatic.com%2Fs2%2Fprofiles%2Fimages%2Fsilhouette80.png",
      "tenantid": "75696069-df44-4310-9bcf-08b45e3007c9",
      "upn": "jeff@foo.onmicrosoft.com",
      "user_id": "office365|10030000838D23AF@MicrosoftOnline.com"
    }
    ```
  </Accordion>

  <Accordion title="ADFS user profile example">
    This is a sample profile from ADFS (Active Directory Federation Services):

    ```json theme={null}
    {
      "email": "john@fabrikam.com",
      "family_name": "Fabrikam",
      "email_verified": false,
      "given_name": "John",
      "identities": [
        {
          "user_id": "john@fabrikam.com",
          "provider": "adfs",
          "connection": "auth10.com",
          "isSocial": false
        }
      ],
      "issuer": "https://adfs.fabrikam.com",
      "name": "John Fabrikam",
      "nickname": "john",
      "picture": "https://secure.gravatar.com/avatar/5426f6b9d63ad92d60e6fe9fdf83aa21?s=480&r=pg&d=https%3A%2F%2Fssl.gstatic.com%2Fs2%2Fprofiles%2Fimages%2Fsilhouette80.png",
      "user_id": "adfs|john@fabrikam.com"
    }
    ```
  </Accordion>
</AccordionGroup>