User Management

Register new users and handle password resets through the API. Registration requires a developer key with FULL user_info access level.

Overview

The User Management endpoints allow applications to register new accounts, handle password recovery flows, and manage user preferences. These are public endpoints (no JWT required), but they do require a valid developer key (devKey) in the request body. The Refresh User Data endpoint requires JWT authentication.

Register

Create a new user account. On success, the user is automatically logged in and a JWT token is returned, identical to the login response. A user_preferences row is also created with optional initial settings.

Request Body

{
  "query": "register",
  "devKey": "your_dev_key",
  "data": {
    "email": "pilot@example.com",
    "password": "securePassword123",
    "firstname": "John",
    "lastname": "Doe",
    "rank": "CAPT",
    "crewcode": "DOEJ",
    "pin": "1234",
    "simbriefId": 132456,
    "userPreferences": {
      "defaultUnit": "METRIC",
      "multiplayerNetwork": "VATSIM"
    }
  }
}

Parameters

userPreferences Object

Success Response

{
  "success": true,
  "apiVersion": "1.3.6",
  "token": "eyJhbGciOiJIUzI1NiIs...",
  "expires": "2025-07-28T12:00:00Z",
  "expiresIn": 2592000,
  "user": {
    "email": "pilot@example.com",
    "firstname": "John",
    "lastname": "Doe",
    "crewcode": "DOEJ",
    "rank": "CAPT",
    "userPreferences": {
      "defaultUnit": "METRIC",
      "onlineServer": "VATSIM",
      "simbriefUserId": 132456,
      ...
    },
    ...
  }
}

Example Request

curl -X POST "https://api.virtualperformancetool.com/api" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "register",
    "devKey": "your_dev_key",
    "data": {
      "email": "pilot@example.com",
      "password": "securePassword123",
      "firstname": "John",
      "lastname": "Doe",
      "rank": "CAPT",
      "pin": "1234",
      "simbriefId": 132456,
      "userPreferences": {
        "defaultUnit": "METRIC",
        "multiplayerNetwork": "VATSIM"
      }
    }
  }'

Request Password Reset

Send a password reset email to the user. The email contains a link with a reset token valid for 1 hour. Rate limited to one request per email per 15 minutes.

Request Body

{
  "query": "requestPasswordReset",
  "devKey": "your_dev_key",
  "data": {
    "email": "pilot@example.com",
    "returnUrl": "vpt://password-reset-success"
  }
}

Parameters

Success Response

{
  "success": true,
  "message": "If an account with this email exists, a password reset link has been sent."
}

Reset Password

Complete the password reset using the token from the reset email. The token is valid for 1 hour from when the reset was requested.

Request Body

{
  "query": "resetPassword",
  "devKey": "your_dev_key",
  "data": {
    "token": "cGlsb3RAZXhhbXBsZS5jb20=.MTcxOTAwMDAwMA==",
    "password": "newSecurePassword456"
  }
}

Parameters

Success Response

{
  "success": true,
  "message": "Password has been reset successfully. You can now log in with your new password.",
  "returnUrl": "vpt://password-reset-success"
}

Password Reset Flow

Refresh User Data

Retrieve the full user object — profile, preferences, subscription state, and unit configuration — without re-authenticating. Returns the same payload as login, minus a new JWT token. Use this to sync user state after preferences change or when resuming from the background.

Request Body

{
  "query": "refreshUserData"
}

Example Request

curl -X POST "https://api.virtualperformancetool.com/api" \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -H "X-API-Version: 1.3.6" \
  -d '{
    "query": "refreshUserData"
  }'

Success Response

{
  "success": true,
  "user": {
    "email": "pilot@example.com",
    "firstname": "John",
    "lastname": "Doe",
    "crewcode": "DOEJ",
    "rank": "CAPT",
    "subscription": {
      "title": "VPT Global - Pro (Yearly)",
      "level": 2,
      "status": "ACTIVE",
      "isActive": true,
      "isExpired": false,
      "expiry": "2099-12-30T00:00:00+01:00",
      "daysRemaining": 26910,
      "capabilities": {
        "isNotam": true,
        "isNnc": true,
        "isMel": true,
        "isCdl": true,
        "isMostFav": true,
        "isBalkedLanding": true,
        "isAllIntersections": true,
        "isCommercial": true,
        "isFleetDatabase": true,
        "maxCalculation": 600
      },
      "preview": { "active": false, "reason": null, "allowedAirports": [], "message": null }
    },
    "ranks": ["LTC", "CAPT", "FO", "JFO"],
    "vaPartners": [
      {
        "id": 1, "name": "VPT Airlines", "website": "https://...", "contactEmail": "contact@vptairlines.com",
        "logo": "https://api.virtualperformancetool.com/va/VPT_Airlines.png"
      }
    ],
    "vaMemberships": [
      {
        "id": 1, "name": "VPT Airlines", "website": "https://...", "contactEmail": "contact@vptairlines.com",
        "isActive": true,
        "logo": "https://api.virtualperformancetool.com/va/VPT_Airlines.png"
      }
    ],
    "activeVa": {
      "id": 1, "name": "VPT Airlines", "website": "https://...", "contactEmail": "contact@vptairlines.com",
      "logo": "https://api.virtualperformancetool.com/va/VPT_Airlines.png"
    },
    "userStatisticsSinceLastLogin": { ... },
    "userPreferences": {
      "settingsLocked": false,
      "displayIntegratedTutorial": true,
      "defaultUnit": "METRIC",
      "onlineServer": "VATSIM",
      "defaultAircraftOnStartup": {
        "file": "320-212-CFM56-5A3.json",
        "userRegistration": null,
        "vaFleet": null
      },
      "performance": {
        "takeoff": {
          "customizeStandardEngineFailureProcedure": true,
          "customizedText": "Maintain [RWY_TRACK]° to 25 NM...",
          "displayEngineFailureInFull": true
        },
        "wb": { "displayGraphicalError": true }
      },
      "export": {
        "signBeforeExport": true,
        "printerPaperWidth_mm": 8,
        "hoppieAutomaticExport": false,
        "hoppieCallsign": null,
        "hoppieServer": "None",
        "hoppieFormat": "Raw"
      },
      "simbrief": {
        "simbriefUserId": 132456,
        "simbriefLoadDeviation": 15,
        "simbriefImportOption": "Simbrief"
      },
      "efb": {
        "enableEFB": true,
        "modules": { "briefingNavlog": true, "checklist": true, "library": true, "tools": true },
        "toolsOptions": null
      },
      "weather": { "display": true, "notification": true }
    }
  },
  "units": {
    "unitConfig": [ ... ],
    "unitDetails": [ ... ]
  }
}

Response Fields

Save User Settings

Update the authenticated user's preferences. API 1.3.0 uses an adaptive partial update: only fields present in the request payload are written; missing keys leave the corresponding DB columns untouched. Unknown keys are silently ignored (forward-compatible).

Request Body — Minimal (single field)

{
  "query": "saveUserSettings",
  "data": {
    "defaultUnit": "IMPERIAL"
  }
}

Request Body — EFB module toggle (nested partial)

{
  "query": "saveUserSettings",
  "data": {
    "efb": {
      "modules": {
        "checklist": false
      }
    }
  }
}

Request Body — Full payload

{
  "query": "saveUserSettings",
  "data": {
    "displayIntegratedTutorial": true,
    "defaultUnit": "METRIC",
    "onlineServer": "VATSIM",
    "defaultAircraftOnStartup": {
      "file": "320-212-CFM56-5A3.json",
      "userRegistration": "F-GKXY",
      "vaFleet": null
    },
    "performance": {
      "takeoff": {
        "customizeStandardEngineFailureProcedure": true,
        "customizedText": "Maintain [RWY_TRACK]° to 25 NM and HOLD.",
        "displayEngineFailureInFull": true
      },
      "wb": { "displayGraphicalError": true }
    },
    "export": {
      "signBeforeExport": true,
      "printerPaperWidth_mm": 8,
      "hoppieAutomaticExport": false,
      "hoppieCallsign": "AFR123",
      "hoppieServer": "VATSIM",
      "hoppieFormat": "MCDU"
    },
    "simbrief": {
      "simbriefUserId": 132456,
      "simbriefLoadDeviation": 15,
      "simbriefImportOption": "Simbrief"
    },
    "efb": {
      "enableEFB": true,
      "modules": {
        "briefingNavlog": true,
        "checklist": true,
        "library": true,
        "tools": true
      },
      "toolsOptions": [
        { "id": "wnb",     "visible": true,  "order": 0 },
        { "id": "weather", "visible": true,  "order": 1 },
        { "id": "fuel",    "visible": false, "order": 2 }
      ]
    },
    "weather": {
      "display": true,
      "notification": true
    }
  }
}

Success Response

{
  "success": true,
  "fieldsUpdated": 1
}

Validation Errors

{
  "error": "Validation failed",
  "details": [
    "defaultUnit: must be one of: METRIC, METRIC_M, IMPERIAL, HYBRID1, HYBRID2, HYBRID3",
    "efb.toolsOptions: toolsOptions[2].order is required"
  ]
}

User Statistics

Retrieve usage statistics for the currently authenticated user. The response includes calculation distribution, top aircraft and airports, usage habits by weekday and hour, and 30-day allowance tracking.

Request Body

{
  "query": "userStatistics"
}

Example Request

curl -X POST "https://api.virtualperformancetool.com/api" \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -H "X-API-Version: 1.3.6" \
  -d '{
    "query": "userStatistics"
  }'

Success Response

{
  "success": true,
  "query": "userStatistics",
  "calculations": {
    "takeoff": 192,
    "landingDispatch": 41,
    "landingEnroute": 58,
    "other": 4,
    "total": 295
  },
  "allowance30d": {
    "baseAllowed": 300,
    "extraCalculationGift": 25,
    "totalAllowed": 325,
    "used": 214,
    "remaining": 111,
    "overage": 0,
    "usagePct": 65.8,
    "windowDays": 30
  },
  "mostUsedAircraft": [
    { "profile": "A320-214 CFM", "total": 88 }
  ],
  "usageHabits": {
    "weekday": [
      { "label": "Monday", "count": 23 }
    ],
    "hourOfDay": [
      { "hour": 14, "label": "14:00", "count": 17 }
    ]
  },
  "mostUsedAirports": [
    { "icao": "LFPG", "total": 15 }
  ],
  "statistics": {
    "libraryUsedBytes": 5242880,
    "libraryAvailableMb": 100
  }
}

Response Fields

Get User Meta

Returns helper data the client needs to render profile / VA forms: allowed rank values, the list of selectable VAs (Virtual Airlines), and the user's current memberships.

Authentication

JWT required. Any user_info dev key level (SIMPLE, MEDIUM or FULL).

Request Body

{
  "query": "getUserMeta"
}

Success Response

{
  "success": true,
  "ranks": ["LTC", "CAPT", "FO", "JFO"],
  "vaPartners": [
    {
      "id": 1,
      "name": "VPT Airlines",
      "website": "https://...",
      "contactEmail": "contact@vptairlines.com",
      "logo": "https://api.virtualperformancetool.com/va/VPT_Airlines.png"
    }
  ],
  "vaMemberships": [
    {
      "id": 1,
      "name": "VPT Airlines",
      "website": "https://...",
      "contactEmail": "contact@vptairlines.com",
      "isActive": true,
      "logo": "https://api.virtualperformancetool.com/va/VPT_Airlines.png"
    }
  ],
  "activeVa": {
    "id": 1,
    "name": "VPT Airlines",
    "website": "https://...",
    "contactEmail": "contact@vptairlines.com",
    "logo": "https://api.virtualperformancetool.com/va/VPT_Airlines.png"
  }
}

Update Profile

Updates one or more profile fields for the authenticated user. Send only the fields you want to change — missing fields are left unchanged.

Authentication

JWT required. Any user_info dev key level.

Editable fields

Request Body

{
  "query": "updateProfile",
  "data": {
    "firstname": "John",
    "rank": "CAPT",
    "activeVaId": 1
  }
}

Success Response

{
  "success": true,
  "updated": ["firstname", "rank", "activeVaId"],
  "user": { /* full user object, see Refresh User Data */ }
}

Profile / Alias Pictures

The user has two image slots: a profile picture (resized to a 512×512 max bounding box) and a streaming alias picture (resized to 1024×1024 max). Both are stored on the server and returned as absolute URLs in the user object as profilePicture and aliasPicture.

Constraints

• Allowed MIME types: image/jpeg, image/png, image/webp
• Maximum upload size: 5 MB
• Server transcodes the image to JPEG (quality 88) and applies the resize

Upload

Send as multipart/form-data with a single file field named image. JWT in the standard Authorization header.

Delete

Success Response (upload)

{
  "success": true,
  "kind": "profile",
  "url": "https://api.virtualperformancetool.com/Library/userImages/42/profile-1730000000.jpg",
  "user": { /* full user object */ }
}

Request Email Change

Two-step flow to change the account email. The confirmation link is sent to the old email address, so an attacker who steals an active session cannot lock the user out of their account. On confirmation, all sessions on every device are invalidated and the user must log in again with the new email.

Authentication

JWT required. The user_info dev key permission must be set to FULL — this is a sensitive operation.

Request Body

{
  "query": "requestEmailChange",
  "data": { "newEmail": "new@example.com" }
}

Success Response

{
  "success": true,
  "message": "A confirmation email has been sent to your current email address."
}

Confirmation Link

The email contains a one-time link to /api?query=confirmEmailChange&token=... — this is a public endpoint. Tokens are valid for 1 hour and can only be used once. Confirmation displays an HTML success page.

Errors

• INSUFFICIENT_PERMISSIONS — dev key is not FULL user_info
• INVALID_EMAIL — new email is missing or malformed
• EMAIL_UNCHANGED — new email matches current
• EMAIL_ALREADY_EXISTS — another account already uses that email

Request Account Deletion

Two-step flow that permanently deletes the account. The user receives a confirmation email; clicking the link runs the actual deletion.

Authentication

JWT required. user_info dev key permission must be FULL. The demo account cannot be deleted.

What gets deleted

• Cancelled: PayPal and 2Checkout subscriptions (no refund for unused time)
• Deleted: users row, user_preferences, va_users memberships, profile/alias pictures (files + columns), user-owned library files (DB row + file on disk), user-owned library folders, library sync state, all subscription rows, any pending email-change or deletion tokens
• Preserved: anonymized usage statistics (opt_statistics) and audit logs (logs_*)

Request Body

{ "query": "requestAccountDeletion" }

Success Response

{
  "success": true,
  "message": "A deletion confirmation email has been sent. The link expires in 1 hour."
}

Confirmation Link

The email contains a one-time link to /api?query=confirmAccountDeletion&token=... — public endpoint, 1-hour TTL, single use. The page also invites the user to send feedback to info@virtualperformancetool.com.

Error Codes

The following error codes may be returned by User Management endpoints: