# Manage users

Providers are identified by `external_provider_id` from your EHR. You can upsert a user before the first encounter, or let [Create encounter](/connect/guides/launch-encounters.md) provision them on first launch. Authenticate with a [server access token](/connect/guides/authentication.md).

Schemas and error responses are in the [API reference](/connect/reference/provision-users.md).

## Provision a user[​](#provision-a-user "Direct link to Provision a user")

**Method:** `POST`

**Path:** [`<baseUrl>/users`](/connect/reference/provision-users.md)

Available from version `2026-03-23`.

Use this when you want to create or update a provider **without** opening an encounter — for example to set specialty and dictation locales before the first launch.

Nabla will:

1. Resolve your organization from the OAuth client used to obtain the token.
2. Look up a user already linked to `external_provider_id`.
3. If found, return that user and merge any `settings` you sent.
4. If not found, create the user, link the EHR practitioner, and return the new user.

Omit `settings` to keep current values.

A brand-new user gets default settings until you send settings or the provider completes onboarding.

warning

If a user already exists for that `external_provider_id`, the email you send must match the email on file. If `external_provider_id` and `provider_email` would point at two different existing users, the request fails with **409 Conflict**.

## User status[​](#user-status "Direct link to User status")

Newly provisioned users are **active**. [Deactivate](/connect/reference/deactivate-user-by-external-id.md) users who should not access Nabla for now but may return (you can [re-activate](/connect/reference/activate-user-by-external-id.md) them) — settings and encounter history are kept (up to the retention period). **[Delete](/connect/reference/delete-user-by-external-id.md)** removes the user and all related data; this cannot be undone.

Re-provisioning a user or creating an encounter for them makes a deactivated user **active** again.

Status endpoints are available from version `2026-07-01`.

danger

Deleting a user permanently removes their settings and encounter history.