# Class UsersController | EchoHub Documentation

# Class UsersController

Namespace
  EchoHub.Server.Controllers

Assembly
  EchoHub.Server.dll

    [ApiController]
    [Route("api/users")]
    [Authorize]
    [EnableRateLimiting("general")]
    public class UsersController : ControllerBase

Inheritance
  object
  ControllerBase
  UsersController

Inherited Members
  object.GetType()
  object.MemberwiseClone()
  object.ToString()
  object.Equals(object)
  object.Equals(object, object)
  object.ReferenceEquals(object, object)
  object.GetHashCode()

## Constructors

### UsersController(IUserService, ImageToAsciiService, UploadLimits, EchoHubDbContext, IMessageEncryptionService, FileStorageService, PresenceTracker, IEnumerable<IChatBroadcaster>, IConfiguration, ILogger<UsersController>)

    public UsersController(IUserService userService, ImageToAsciiService asciiService, UploadLimits uploadLimits, EchoHubDbContext db, IMessageEncryptionService encryption, FileStorageService fileStorage, PresenceTracker presenceTracker, IEnumerable<IChatBroadcaster> broadcasters, IConfiguration config, ILogger<UsersController> logger)

#### Parameters

`userService` IUserService
`asciiService` ImageToAsciiService
`uploadLimits` UploadLimits
`db` EchoHubDbContext
`encryption` IMessageEncryptionService
`fileStorage` FileStorageService
`presenceTracker` PresenceTracker
`broadcasters` IEnumerable<IChatBroadcaster>
`config` IConfiguration
`logger` ILogger<UsersController>

## Fields

### DeletedUserName

Username tombstoned messages are re-attributed to after account deletion. Reserved — UserService refuses to register it.

    public const string DeletedUserName = "deleted-user"

#### Field Value

string

## Methods

### DeleteMyAccount(DeleteAccountRequest)

Self-service account deletion (password re-confirmed). Removes the account, its refresh tokens and memberships (FK cascade), and every attachment blob the user uploaded. Their messages are kept but tombstoned to DeletedUserName — deleting them outright would silently gut other people's conversations.

    [HttpDelete("me")]
    public Task<IActionResult> DeleteMyAccount(DeleteAccountRequest request)

#### Parameters

`request` DeleteAccountRequest

#### Returns

Task<IActionResult>

### ExportMyData()

Everything the server stores about the caller, as stored: profile, their messages (end-to-end encrypted room content stays ciphertext — the server never had plaintext), and metadata of their uploaded attachments. "You own the data" made demonstrable.

    [HttpGet("me/export")]
    public Task<IActionResult> ExportMyData()

#### Returns

Task<IActionResult>

### GetProfile(string)

    [HttpGet("{username}/profile")]
    public Task<IActionResult> GetProfile(string username)

#### Parameters

`username` string

#### Returns

Task<IActionResult>

### UpdateProfile(UpdateProfileRequest)

    [HttpPut("profile")]
    public Task<IActionResult> UpdateProfile(UpdateProfileRequest request)

#### Parameters

`request` UpdateProfileRequest

#### Returns

Task<IActionResult>

### UploadAvatar()

    [HttpPost("avatar")]
    [EnableRateLimiting("upload")]
    public Task<IActionResult> UploadAvatar()

#### Returns

Task<IActionResult>