List users
GET/users
Returns directory users known to the server (synchronized from the configured domains).
Each user carries an access.role only on the single-user endpoint; the list returns the default field set (distinguishedName, displayName, cn, sn, sAMAccountName, objectSid, domain_fqdn, domain_netbios) plus the object id.
Any other user field can be used as an equality filter in the query string. Unknown or
non-selectable fields return 400. With advanced, the filter operators of the advanced
query syntax apply and select can choose the returned fields.
The response is a JSON array by default. With inlinePageInfo the body is wrapped in a
paging envelope. Paging is also reported in X-Pagination-* headers and the Link header.
Required role: user, admin or superadmin (any authenticated user).
Request
Responses
- 200
- 400
- 401
- 403
A page of users.
Response Headers
Number of records in this page.
Page size used for the request (limit).
Current page number.
Total number of pages.
Total number of records matching the query.
RFC 8288 links with rel values first, last, and, when they exist, prev and next.
Invalid query (unknown field or non-string value). Typed error body.
No token, or the token is invalid or expired. The body is {message}: No auth token provided when no token is sent, otherwise the token check's message (jwt expired, jwt malformed, invalid signature, invalid token, jwt signature is required). Send Authorization: Bearer <token> exactly: the server drops the first seven characters of the header and reads the rest as the token, so a different scheme or an extra space fails. If Authorization is absent, the server reads a token field in the body, then a token query parameter, then x-access-token. Routes that validate query fields reject ?token= with 400 InvalidQuery.
The token's role is not allowed for this operation, or the token's scopes exclude the route
(Scope not allowed by token).