List all users (auditor-only)
const url = 'https://example.com/api/admin/users?limit=25&q=alice&status=active';const options = {method: 'GET', headers: {'X-Ssoossh-Key-Secret': '<X-Ssoossh-Key-Secret>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url 'https://example.com/api/admin/users?limit=25&q=alice&status=active' \ --header 'X-Ssoossh-Key-Secret: <X-Ssoossh-Key-Secret>'Returns a paginated list of users, searchable by name, username, email, or subject, and filterable by account state. Useful for user directory and audit. Ordered by name ignoring case (users with no name last, by username), then username, then id. Uses cursor-based pagination (not offset): pass the previous page’s next_cursor as after.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Query Parameters
Section titled “Query Parameters”User ID to start after (cursor): the previous page’s next_cursor
Page size (default 25, max 100)
Example
25Search term matched against name, username, email, and subject
Example
aliceAccount state filter: active or disabled; omitted returns both
Responses
Section titled “Responses”User list
object
NextCursor is the after for the following page: the id of this page’s last user, absent on the last page.
Total is how many users match the search and state filter, across all pages.
object
CreatedAt is when the user first authenticated.
DisabledAt is when an admin disabled this user. Omitted (null) if not disabled.
DisabledByUsername is the username of the admin that disabled this user. Only populated when DisabledAt is non-null.
Email is the user’s email from OIDC, possibly empty or changed at login.
ID is the stable user identifier.
Name is the person’s human-readable name, so a list of usernames can be scanned by someone who thinks in names. Display only, and empty when nothing supplied one.
Subject is the unique account identifier (authentication.fields.subject, “sub” by default) — the one field here that is stable across logins.
UpdatedAt is when the user’s identity was last refreshed at login.
Username is the OIDC claim username, possibly changed at each login.
Example generated
{ "next_cursor": "example", "total": 1, "users": [ { "created_at": "example", "disabled_at": "example", "disabled_by_username": "example", "email": "example", "id": "example", "name": "example", "subject": "example", "updated_at": "example", "username": "example" } ]}Invalid paging/search parameters, an after that names no user, or offset
object
Data is always null on an error response.
Error is a human-readable message. Branch on the HTTP status rather than this string; it is for humans and logs.
ErrorCode is a machine-readable error classifier. One of the error_code constants from internal/apitypes; use this to decide whether to retry or branch on the failure mode.
Example
{ "error": "certificate request \"9f1c…\" not found", "error_code": "not_found"}Not authenticated
object
Data is always null on an error response.
Error is a human-readable message. Branch on the HTTP status rather than this string; it is for humans and logs.
ErrorCode is a machine-readable error classifier. One of the error_code constants from internal/apitypes; use this to decide whether to retry or branch on the failure mode.
Example
{ "error": "certificate request \"9f1c…\" not found", "error_code": "not_found"}Not authorized as auditor
object
Data is always null on an error response.
Error is a human-readable message. Branch on the HTTP status rather than this string; it is for humans and logs.
ErrorCode is a machine-readable error classifier. One of the error_code constants from internal/apitypes; use this to decide whether to retry or branch on the failure mode.
Example
{ "error": "certificate request \"9f1c…\" not found", "error_code": "not_found"}