# Implement Remote User Management

Remote User Management is a postback to your server. Verotel tells you to add, rebill, cancel, modify, or delete a user. FlexPay does not send these postbacks. If this skill and the product page disagree, follow the product page.

## Read first

1. [Remote User Management](/en/remote-user-management) for each postback and its fields
2. [Remote User Management OpenAPI](/openapi/remote-user-management.json) for the same calls as a specification

## Implement in this order

1. Publish the script URL Verotel will call.
2. Branch on `trn`: `add`, `rebill`, `cancel`, `modify`, or `delete`.
3. On `add`, create the account with the posted `usercode` and `passcode`.
4. Reply with the plain text `APPROVED` when the change is done, `DECLINED` when you will not apply it, or `ERROR` on a technical failure.
5. Treat a later `cancel` or `delete` as removal of access. `modify` changes the passcode.

## Credentials

- The postback is authenticated by being the script Verotel calls. Read the field list on the product page before trusting a request.
- There is no shopper password to invent. `add` and `modify` carry the passcode.

## Traps

- The success body is the word `APPROVED`. Another body is a failure. Verotel retries a non-`APPROVED` response twice over about 20 minutes, then can refund the debit. Repeated failures can suspend the account.
- FlexPay success postbacks are a different protocol. Do not answer a FlexPay postback with `APPROVED`, and do not expect a Remote User Management postback from FlexPay.
- `usercode` and `passcode` are short alphanumeric values. Take the length limits from the product page.

## Done when

An `add` postback creates a user who can sign in with the posted `usercode` and `passcode`, and the script answers `APPROVED`.

## Reference

- [User management](/en/remote-user-management)