The discussion revolves around using the Discourse API to retrieve all user emails for verification purposes. alank initially explores the API, but finds that it only allows searching for usernames or names, not email addresses.
Falco suggests using the Data Explorer plugin to create a query and retrieve user emails via the API. However, alank prefers to use the API directly without implementing a plugin.
Falco explains that the API does not expose bulk email retrieval due to logging and security concerns.
alank provides context about their use case, which involves Auth0 SSO authorization between their app and Discourse. They want to verify if a user’s email is registered on Discourse when they log in to their app.
Falco recommends using the Discourse SSO feature, which allows querying the existence of a user by their external unique ID using the GET https://example.com/u/by-external/<EXTERNAL_ID> endpoint.
I’ve seen this link: Is there a way to get a user email adress from the API?
However we need to verify in a different service, using the Discourse API, if an email exists on the Discourse site. We can search for username or name via /u/search/users.json, but these do not appear to return the email address.
So can you search or query all emails for comparison?
You can use the Data Explorer plugin to create a query and then hit the query API afterwards in a query like SELECT * FROM user_emails.
At per user there is also the https://meta.discourse.org/u/<username>/emails.json endpoint.
Yes the link included in my initial question is “Discourse Meta/emails.json” but is there a way to get all user emails? … I would rather use the API then implement a plugin that allows SQL queries if at all possible.
Our API endpoints are the ones consumed by the web app, since we log email queries on the webapp we don’t expose anywhere to bulk grab emails.
The only way, right now, is using the above mentioned Data Explorer based solution.
Just to be clear, we are using the API, via secret key, I understand that the front-end would not have the same rights, can the API not have access though?
To give more details, we are have an app and discourse, both on Auth0 SSO authorization, however if someone logs into our app we want to make sure they have an account Discourse (and direct them to that link). Maybe it’s not the best way to check if Discourse has registered that email if they come to our site first. That is a link to Discourse in the event that the email has not been registered
If you are using true Discourse SSO, you can query the existence of a user by their external unique ID passed in the SSO payload using GET https://example.com/u/by-external/<EXTERNAL_ID>