List organization members

GET

/api/v1/organizations/{orgId}/members

const url = 'http://localhost:3000/api/v1/organizations/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/members?search=john&email=john.doe%40example.com&active=true&isSuperAdmin=false&include=organizations&limit=50&offset=0';
const options = {method: 'GET', headers: {'X-API-Key': '<X-API-Key>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'http://localhost:3000/api/v1/organizations/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/members?search=john&email=john.doe%40example.com&active=true&isSuperAdmin=false&include=organizations&limit=50&offset=0' \
  --header 'X-API-Key: <X-API-Key>'

Retrieves a list of members in the organization.

Authorizations

api-key
bearer

Parameters

Path Parameters

orgId

required

string format: uuid

Organization UUID

Query Parameters

search

string

Example

john

Search term for user name or email

email

string format: email

Example

john.doe@example.com

Filter by exact email address

active

boolean

Example

true

Filter by active status

isSuperAdmin

boolean

Example

false

Filter by super admin status

include

string

Example

organizations

Include related data. Use “organizations” to include organization memberships.

limit

number

default: 50 >= 1 <= 100

Example

Maximum number of results to return

offset

number

Example

Number of results to skip for pagination

Header Parameters

x-organization-id

string format: uuid

UUID of the organization (tenant) the request acts in. It selects the tenant and grants nothing: the server checks membership or an open tenant switch. Not needed for global operations. A malformed value returns 400. API keys are fixed to their own organization; another organization returns 403. The x-organization-source header grants nothing.

Responses

200

Members retrieved successfully

application/json

object

items

required

List of users

Array<object>

object

required

Unique user identifier

string format: uuid

email

required

User email address

string format: email

name

User display name

string

active

required

Whether the user account is active

boolean

emailVerified

required

Whether the user email has been verified

boolean

isSuperAdmin

required

Whether the user is a super admin with platform-wide privileges

boolean

createdAt

required

When the user was created

string format: date-time

updatedAt

required

When the user was last updated

string format: date-time

lastLoginAt

When the user last logged in

string format: date-time

identityProvider

FM-1069: the Keycloak identity-provider alias the user last authenticated through (e.g. the Entra broker alias), or null for a local realm login.

string

isFederated

required

FM-1069: whether the user authenticates through an external identity provider (federated). The UI hides the password-reset action when true, since federated users have no local password to reset.

boolean

pendingEmailVerification

required

True when this account cannot sign in to its organizations because its e-mail address is unverified AND it is not yet bound to a Keycloak identity. Both conditions matter: an unverified address only blocks the e-mail-keyed binding (FM-837), which is never attempted for an account that is already bound. An already-bound account with an unverified address signs in perfectly well, so flagging it would be a false alarm.

boolean

hasKeycloakLink

required

FM-1286: whether this account is bound to a Keycloak identity (users.keycloakId is set). A Super Admin can clear the binding when the Keycloak account was re-created, so the account re-links on its next sign-in with memberships intact. The Keycloak id itself is not exposed.

boolean

total

required

Total number of users matching the query

number

limit

required

Number of results returned

number

offset

required

Number of results skipped

number

Example

{
  "items": [
    {
      "id": "550e8400-e29b-41d4-a716-446655440000",
      "email": "john.doe@example.com",
      "name": "John Doe",
      "active": true,
      "emailVerified": true,
      "isSuperAdmin": false,
      "createdAt": "2024-01-15T10:30:00Z",
      "updatedAt": "2024-06-20T14:45:00Z",
      "lastLoginAt": "2024-12-20T09:15:00Z",
      "identityProvider": "entra",
      "isFederated": false,
      "pendingEmailVerification": false,
      "hasKeycloakLink": true
    }
  ],
  "total": 100,
  "limit": 50,
  "offset": 0
}

401

Unauthorized

403

Forbidden - Insufficient permissions

404

Organization not found