> ## Documentation index > Fetch the complete documentation index at: https://developer.rhombus.com/llms.txt > Use it to discover all available pages before exploring further. # Save user metadata fields > Saves custom metadata values for the user specified. Template IDs that do not map to an actual org metadata template are ignored and values for omitted Template IDs are left as-is. ```http POST https://api2.rhombussystems.com/api/user/metadata/saveUserMetadataFields ``` EU organizations send the same request to `https://api2.eu.rhombussystems.com`. ## Authentication and parameters - `x-auth-apikey` (header, required): Your Rhombus API key. Must be accompanied by the `x-auth-scheme` header set to `api-token` (or `partner-api-token` for partner endpoints). - `Authorization` (header): instead of an API key, an OAuth access token (`Bearer `) with the `write` scope. - `x-auth-scheme` (header, string, default: `api-token`): Authentication scheme identifier. Use `api-token` or `partner-api-token` with the `x-auth-apikey` header, `api` or `partner-api` with `x-auth-apikey` plus a client certificate, `api-oauth-token` or `partner-api-oauth-token` with `x-auth-access-token`, and `federated-token` with `x-auth-ft`. A request with `Authorization: Bearer ` and no `x-auth-scheme` is treated as OAuth, and `federated-token` may also be sent as the `x-auth-scheme` and `x-auth-ft` query parameters. One of: `api-token`, `api`, `api-oauth-token`, `federated-token`, `partner-api-token`, `partner-api`, `partner-api-oauth-token`. - `x-auth-org` (header, string): Client organization UUID (22-character RUUID), for partner credentials only. With it the call runs in that client organization with the partner support authority's role. Without it a partner credential runs as the partner organization, which outside the partner endpoints is deprecated (responses carry `Deprecation` and `Sunset: Tue, 05 Jan 2027 00:00:00 GMT`). A malformed value returns 400 `INVALID_AUTH_ORG`; a client organization the partner cannot access returns 403 `PARTNER_CLIENT_ACCESS_DENIED`. ## Request body Content type: `application/json` - `fieldValueMap` (map | null) - `userUuid` (string | null): base 64 (url-safe) uuid string ## Response 200 OK. Content type: `application/json` - `templateMap` (map | null) - `userFieldValueMap` (map | null) ## Errors Also 400, 401, 403, 429, 500, 503 with the standard error body (`errorCode`, `errorMsg`): https://developer.rhombus.com/errors ## OpenAPI ````yaml openapi: 3.0.1 info: title: Rhombus API version: "1.0" servers: - description: Production Server url: https://api2.rhombussystems.com security: - ApiKeyAuth: [] paths: /api/user/metadata/saveUserMetadataFields: post: description: Saves custom metadata values for the user specified. Template IDs that do not map to an actual org metadata template are ignored and values for omitted Template IDs are left as-is. operationId: saveUserMetadataFields parameters: - description: "Authentication scheme identifier. Use `api-token` or `partner-api-token` with the `x-auth-apikey` header, `api` or `partner-api` with `x-auth-apikey` plus a client certificate, `api-oauth-token` or `partner-api-oauth-token` with `x-auth-access-token`, and `federated-token` with `x-auth-ft`. A request with `Authorization: Bearer ` and no `x-auth-scheme` is treated as OAuth, and `federated-token` may also be sent as the `x-auth-scheme` and `x-auth-ft` query parameters." example: api-token in: header name: x-auth-scheme required: false schema: default: api-token enum: - api-token - api - api-oauth-token - federated-token - partner-api-token - partner-api - partner-api-oauth-token type: string - description: "Client organization UUID (22-character RUUID), for partner credentials only. With it the call runs in that client organization with the partner support authority's role. Without it a partner credential runs as the partner organization, which outside the partner endpoints is deprecated (responses carry `Deprecation` and `Sunset: Tue, 05 Jan 2027 00:00:00 GMT`). A malformed value returns 400 `INVALID_AUTH_ORG`; a client organization the partner cannot access returns 403 `PARTNER_CLIENT_ACCESS_DENIED`." in: header name: x-auth-org required: false schema: format: RUUID maxLength: 22 minLength: 22 type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/User_metadata_SaveUserMetadataFieldsWSRequest" responses: "200": content: application/json: schema: $ref: "#/components/schemas/User_metadata_SaveUserMetadataFieldsWSResponse" description: OK "400": $ref: "#/components/responses/BadRequest" "401": $ref: "#/components/responses/Unauthorized" "403": $ref: "#/components/responses/Forbidden" "429": $ref: "#/components/responses/TooManyRequests" "500": $ref: "#/components/responses/InternalServerError" "503": $ref: "#/components/responses/ServiceUnavailable" security: - ApiKeyAuth: [] - oauth2: - write summary: Save user metadata fields tags: - User Metadata Webservice components: schemas: User_metadata_SaveUserMetadataFieldsWSRequest: properties: fieldValueMap: additionalProperties: nullable: true type: string nullable: true type: object userUuid: description: base 64 (url-safe) uuid string example: AAAAAAAAAAAAAAAAAAAAAA format: RUUID nullable: true type: string type: object User_metadata_SaveUserMetadataFieldsWSResponse: properties: templateMap: additionalProperties: $ref: "#/components/schemas/UserMetadataFieldTemplate" nullable: true type: object userFieldValueMap: additionalProperties: $ref: "#/components/schemas/UserMetadataField" nullable: true type: object type: object UserMetadataFieldTemplate: properties: createdAtMillis: format: int64 nullable: true type: integer fieldName: nullable: true type: string orgUuid: description: base 64 (url-safe) uuid string example: AAAAAAAAAAAAAAAAAAAAAA format: RUUID nullable: true type: string scimFieldName: nullable: true type: string updatedAtMillis: format: int64 nullable: true type: integer uuid: description: base 64 (url-safe) uuid string example: AAAAAAAAAAAAAAAAAAAAAA format: RUUID nullable: true type: string type: object UserMetadataField: properties: createdAtMillis: format: int64 nullable: true type: integer fieldValue: nullable: true type: string orgUuid: description: base 64 (url-safe) uuid string example: AAAAAAAAAAAAAAAAAAAAAA format: RUUID nullable: true type: string templateUuid: description: base 64 (url-safe) uuid string example: AAAAAAAAAAAAAAAAAAAAAA format: RUUID nullable: true type: string updatedAtMillis: format: int64 nullable: true type: integer userUuid: description: base 64 (url-safe) uuid string example: AAAAAAAAAAAAAAAAAAAAAA format: RUUID nullable: true type: string type: object securitySchemes: ApiKeyAuth: description: Your Rhombus API key. Must be accompanied by the `x-auth-scheme` header set to `api-token` (or `partner-api-token` for partner endpoints). in: header name: x-auth-apikey type: apiKey oauth2: description: 'OAuth 2.0 authorization code flow with PKCE (`S256`). Send the access token as `Authorization: Bearer `. Each operation lists the scopes it requires; a token without them is refused 403 with `WWW-Authenticate: Bearer error="insufficient_scope"`.' flows: authorizationCode: authorizationUrl: https://console.rhombus.com/oauth/authorize refreshUrl: https://auth-web.rhombussystems.com/oauth/token scopes: physical: Unlock doors and elevators, lockdown, alarms, speakers and robots read: View cameras, footage and settings write: Change settings and data tokenUrl: https://auth-web.rhombussystems.com/oauth/token type: oauth2 ````