Users

Your users: set one up, read their spend, change their cap, export or erase them.

Send Authorization: Bearer vk_test_... on every call. Every route of Users.

PATCH/v1/users/{user_id}Change name, language, time zone, metadata, day or month spend cap, default deployment, or status (active or disabled).

Your API key, scope admin or all. On the card: users. Every call here is a checked sample.

Request10 fields

Path

user_idstringrequiredYour own id for the user, as you named them.

Type: string

Body

namestring | nullA new name; null clears it.

Limits: 1 to 200 characters.

emailstring (email) | nullA new email address; null clears it.

Limits: At most 320 characters.

localestring | nullA new language and region (BCP 47); null clears it.

Limits: 2 to 35 characters.

timezonestring | nullA new time zone (IANA); null clears it, and their routines then run in UTC.

Limits: 1 to 64 characters.

metadatamap of anyYour facts about the user: this takes the place of what was there.

Type: map of any

spend_cap_usdnumber | nullTheir own cap per day, in US dollars, never above your company's; null goes back to your company's cap for each user.

Limits: 0 to 1000000.

monthly_cap_usdnumber | nullTheir own cap per calendar month, in US dollars; null goes back to your company's cap for each user.

Limits: 0 to 1000000.

default_deploymentstring | nullThe deployment their conversations use when none is named: its id or name; null goes back to your company's default.

Limits: At least 1 character.

status"active" | "disabled"disabled refuses their calls (403 user_disabled) until you set active again.

Type: "active" | "disabled"

Answers 20017 fields

idstringYour own id for the user.

Example: traveller-42

object"user"Always user.

Type: "user"

namestring | nullThe user's name; null when you gave none.

Type: string | null

emailstring | nullThe user's email address; null when you gave none.

Type: string | null

localestring | nullThe user's language and region (BCP 47); null when you gave none.

Type: string | null

timezonestring | nullThe user's time zone (IANA); null when you gave none, and their routines then run in UTC.

Type: string | null

metadatamap of anyYour own facts about the user; empty when you gave none.

Type: map of any

status"active" | "disabled"active, or disabled: a disabled user's calls are refused (403 user_disabled) until you turn them back on.

Type: "active" | "disabled"

spend_cap_usdnumber | nullThe user's own cap per day, in billed US dollars, never above your company's; null: your company's cap for each user, if any.

Type: number | null

monthly_cap_usdnumber | nullThe user's own cap per calendar month (UTC), in billed US dollars; null: your company's cap for each user, if any.

Type: number | null

default_deploymentstring | nullThe deployment their conversations use when none is named (dep_...); null: your company's default.

Type: string | null

memory_mode"vestra" | "customer" | "none"Where Bash's memory of this user lives: vestra, customer (your memory endpoint), or none.

Type: "vestra" | "customer" | "none"

is_service_userbooleantrue for a user Vestra keeps for itself, such as your company's own Bash; false for your users.

Type: boolean

created_atstringWhen the user was made, as an ISO 8601 time.

Type: string

spend_today_usdnumberWhat they have spent today (UTC), in billed US dollars.

Example: 1.24

spend_month_usdnumberWhat they have spent this calendar month (UTC), in billed US dollars.

Example: 18.6

caps_remainingobjectWhat is left under every cap that applies to them: the smaller of their own and your company's.

day_usdnumber | nullWhat they may still spend today, in US dollars; null when no cap applies.

Type: number | null

month_usdnumber | nullWhat they may still spend this month, in US dollars; null when no cap applies.

Type: number | null

TypeScript

await vestra.user('traveller-42').update({ monthly_cap_usd: 20 });

Python

vestra.user("traveller-42").update(monthly_cap_usd=20)

CLI

vestra users traveller-42 --cap 20

HTTP

# Create a user. Do it before their first ask to set their name and time zone. It is safe to repeat with the# same user_id.curl "$VESTRA_BASE_URL/v1/users" \  -H "Authorization: Bearer $VESTRA_API_KEY" \  -H "Content-Type: application/json" \  -d '{ "user_id": "traveller-42", "name": "Priya Sharma", "timezone": "Asia/Kolkata" }' # Read their spend. Their profile shows what they spent today and this month, against their caps.curl "$VESTRA_BASE_URL/v1/users/traveller-42" \  -H "Authorization: Bearer $VESTRA_API_KEY" # Set a monthly cap. This one is 20 US dollars.curl -X PATCH "$VESTRA_BASE_URL/v1/users/traveller-42" \  -H "Authorization: Bearer $VESTRA_API_KEY" \  -H "Content-Type: application/json" \  -d '{ "monthly_cap_usd": 20 }' # Wake their computer. Do it before they need it.curl -X POST "$VESTRA_BASE_URL/v1/users/traveller-42/warm" \  -H "Authorization: Bearer $VESTRA_API_KEY" # Open a page in their browser with no model, and keep the page's own data calls. The site must be in their# deployment's browser.allowed_domains.curl -X POST "$VESTRA_BASE_URL/v1/users/traveller-42/browser/fetch" \  -H "Authorization: Bearer $VESTRA_API_KEY" \  -H "Content-Type: application/json" \  -d '{ "url": "https://www.ixigo.com/search/result/flight?from=DEL&to=GOI&date=06112026&adults=2&class=e", "capture": [{ "match": "/flights/v2/search/stream" }] }' # Erase a user. It runs as a job: the response is 202 with deleted false and status deleting, and then# user.deleted says it is done.curl -X DELETE "$VESTRA_BASE_URL/v1/users/traveller-42" \  -H "Authorization: Bearer $VESTRA_API_KEY"

MCP

{  "method": "tools/call",  "params": {    "name": "users_get",    "arguments": { "user": "traveller-42" }  }}