Auth0 User Profile Attribute Schema

Auth0’s normalized user profile consists of the following attributes. Each attribute indicates whether it is supported for search, update, import, upsert, and export.

User profile attributes

For Auth0 database connections, all characters are converted to lowercase when saved to the user profile. When not using the Auth0 user store (for example, custom database connections with import mode off, or other connection types), the email is retained as-is and not converted to lowercase.

object

update

import

upsert

export

Custom fields that store info about a user that influences the user’s access, such as support plan, security roles (if not using the Authorization Core feature set), or access control groups. To learn more, read Metadata Overview.

boolean

update

import

export

Indicates whether the user has been blocked. Importing enables subscribers to ensure that users remain blocked when migrating to Auth0.

object[]

IP addresses that have been blocked under suspicion of a bruteforce attack.

date time

export

Timestamp indicating when the user profile was first created.

string

update

import

export

(unique) The user’s email address.The maximum length is 64 characters for the user/local part and 256 characters for the domain part. This value is validated by the JSON validation schema.

boolean

update

import

upsert

export

Indicates whether the user has verified their email address.

string

update

import

upsert

export

The user’s family name.The length can be 1-150 characters and it can contain any UTF-8 character.

string

update

import

upsert

export

The user’s given name.The length can be 1-150 characters and it can contain any UTF-8 character.

object[]

Detailed information about the guardian backup authorization methods the user has set up, including SMS and Recovery Codes.

object[]

export

Contains info retrieved from the identity provider with which the user originally authenticates. Users may also link their profile to multiple identity providers; those identities will then also appear in this array. The contents of an individual identity provider object varies by provider, but it will typically include the following:

connection (text): Name of the Auth0 connection used to authenticate the user.
isSocial (boolean): Whether the connection is a social one.
provider (text): Name of the entity that is authenticating the user, such as Facebook, Google, SAML, or your own provider.
user_id (text): User’s unique identifier for this connection/provider.
profileData (object): User info associated with the connection. When profiles are linked, it is populated with the associated user info for secondary accounts.

In some cases, it will also include an API Access Token to be used with the provider.

string

export

IP address associated with the user’s last login.

Timestamp indicating when the user last logged in. If a user is blocked and logs in, the blocked session updates last_login. If you are using this property from inside a Rule using the user< object, its value will be associated with the login that triggered the rule; this is because rules execute after login.

date time

export

Timestamp indicating the last time the user’s password was reset/changed. At user creation, this field does not exist. This property is only available for Database connections.

integer

export

Number of times the user has logged in. If a user is blocked and logs in, the blocked session is counted in logins_count.

string[]

export

List of multi-factor providers with which the user is enrolled.

date time

export

Date and time of the last update to a user’s multifactor authentication.

string

update

import

upsert

export

The user’s full name.The length can be 1-150 characters and it can contain any UTF-8 character.

string

update

import

upsert

export

The user’s nickname.The length can be 1-350 characters and it can contain any UTF-8 character.

string

update

export

The user’s phone number. Only valid for users with SMS connections.Phone numbers must be in E.164 format and are validated against the regular expression ^\+[0-9]{1,15}$.

boolean

update

export

Indicates whether the user has been verified their phone number. Only valid for users with SMS connections.

string

update

import

upsert

export

URL pointing to the user’s profile picture.

string

Name of the tenant being used.

date time

export

Timestamp indicating when the user’s profile was last updated/modified. Changes to last_login are considered updates, so most of the time, updated_at will match last_login.

string

import

export

(unique) The user’s identifier. Importing allows user records to be synchronized across multiple systems without using mapping tables.

object

update

import

upsert

export

Custom fields that store info about a user that does not impact what they can or cannot access, such as work address, home address, or user preferences. To learn more, read Metadata Overview.

string

update

import

export

(unique) The user’s username.The default allowed length for usernames is between 1 and 15 characters up to a maximum length of 128 characters. The username field accepts alphanumeric characters without accent marks, automatically converted to lowercase, and the following special characters:

at sign, @, but email addresses are not allowed
backtick, `
caret, ^
dollar sign, $
exclamation mark, !
minus, -
number sign, #
period, .
plus, +
single quote, '
tilde, ~
underscore, _

No other characters/symbols are allowed, and Auth0 does not validate or sanitize custom database inputs.

Password validation

Auth0 accepts a specific validation schema for passwords:

password: The minimum password length you can set is 1 byte, while the maximum is 72 bytes. Passwords support ASCII characters in the range of 33-126.
password_hash (text): Hashed password for the user’s connection. When users are created, Auth0 uses bcrypt to secure the password. Importing compatible hashed passwords allows users to retain their passwords, thereby providing a smoother experience. Compatible passwords should be hashed using bcrypt {"$2a$"} or {"$2b$"} and have 10 saltRounds. You can provide this field only when the user is first imported; you cannot update it later.
custom_password_hash (object): Hashed password for the user’s connection when created using an alternate algorithm. Used in place of the password_hash field. During the bulk import process, you can update the custom_password_hash if the user did not login using the initially imported custom_password_hash.

User profile examples

Google user profile example

This is a sample user profile from a user that logged in through Google:

{
  "email": "johnfoo@gmail.com",
  "email_verified": true,
  "family_name": "Foo",
  "gender": "male",
  "given_name": "John",
  "identities": [
    {
      "provider": "google-oauth2",
      "user_id": "103547991597142817347",
      "connection": "google-oauth2",
      "isSocial": true
    }
  ],
  "locale": "en",
  "name": "John Foo",
  "nickname": "FooJon",
  "picture": "https://lh4.googleusercontent.com/-OdsbOXom9qE/AAAAAAAAAAI/AAAAAAAAADU/_j8SzYTOJ4I/photo.jpg",
  "user_id": "google-oauth2|103547991597142817347"
}

Microsoft Account user profile example

This is a sample profile from Microsoft Account:

{
  "email": "bobdoe@outlook.com",
  "email_verified": true,
  "emails": [
    "bobdoe@outlook.com",
    "bobdoe@outlook.com"
  ],
  "family_name": "Doe",
  "given_name": "Bob",
  "identities": [
    {
      "provider": "windowslive",
      "user_id": "4cf0a30169d55031",
      "connection": "windowslive",
      "isSocial": true
    }
  ],
  "locale": "en_US",
  "name": "Bob Doe",
  "nickname": "doebob@outlook.com",
  "picture": "https://secure.gravatar.com/avatar/c89b2bb92df91508e14172097a5e17da?s=480&r=pg&d=https%3A%2F%2Fssl.gstatic.com%2Fs2%2Fprofiles%2Fimages%2Fsilhouette80.png",
  "user_id": "windowslive|4cf0a30169d55031"
}

Office 365 user profile example

This is a sample profile from Office 365 (Microsoft Azure Active Directory):

{
  "email": "jeff@foo.onmicrosoft.com",
  "family_name": "Jeff",
  "given_name": "Beth",
  "identities": [
    {
      "user_id": "10030000838D23AF@MicrosoftOnline.com",
      "provider": "office365",
      "connection": "foo-onmicrosoft",
      "isSocial": false
    }
  ],
  "name": "Jeff Beth",
  "nickname": "jeff@auth0.onmicrosoft.com",
  "picture": "https://secure.gravatar.com/avatar/a7f86ddd090d5a4cb833b97baab2aca1?s=480&r=pg&d=https%3A%2F%2Fssl.gstatic.com%2Fs2%2Fprofiles%2Fimages%2Fsilhouette80.png",
  "tenantid": "75696069-df44-4310-9bcf-08b45e3007c9",
  "upn": "jeff@foo.onmicrosoft.com",
  "user_id": "office365|10030000838D23AF@MicrosoftOnline.com"
}

ADFS user profile example

This is a sample profile from ADFS (Active Directory Federation Services):

{
  "email": "john@fabrikam.com",
  "family_name": "Fabrikam",
  "email_verified": false,
  "given_name": "John",
  "identities": [
    {
      "user_id": "john@fabrikam.com",
      "provider": "adfs",
      "connection": "auth10.com",
      "isSocial": false
    }
  ],
  "issuer": "https://adfs.fabrikam.com",
  "name": "John Fabrikam",
  "nickname": "john",
  "picture": "https://secure.gravatar.com/avatar/5426f6b9d63ad92d60e6fe9fdf83aa21?s=480&r=pg&d=https%3A%2F%2Fssl.gstatic.com%2Fs2%2Fprofiles%2Fimages%2Fsilhouette80.png",
  "user_id": "adfs|john@fabrikam.com"
}

Manage Users

Manage Access

Auth0 User Profile Attribute Schema

User profile attributes

Password validation

User profile examples

​User profile attributes

​Password validation

​User profile examples

User profile attributes

Password validation

User profile examples