List users
GET/users
Returns one page of the people in your tenant, in the order the directory hands them back.
The items are summaries, not users. Each entry carries four fields
(id, username, email, enabled) and nothing else. This is not the
same object GET /users/{username} returns: that operation answers with
the directory's own representation of the user, a larger object with
different field names. Fetch a user individually when you need anything
beyond the four fields here.
The wrapper around the array carries eight keys: the array itself, the
four pagination counters, count for the number of items actually in
this page, and realm and customerId identifying the tenant the path
resolved to. Other Prism list endpoints return a similar-looking wrapper
with a different key set, so read the fields you need rather than
assuming one shape across the API.
Watch the pageSize limit. The largest page this endpoint will serve
is 1000, and an out-of-range value is not trimmed to the maximum; it
resets to the default of 25. Asking for pageSize=5000 therefore returns
25 users, not 1000, with pageSize: 25 in the body and no warning
anywhere. The same reset applies to pageSize=0, to negatives, and to
anything that is not a number. Read pageSize back from the response
whenever you did not send a value you are certain of.
One reporting caveat: if the count query behind total fails, Prism
falls back to the number of rows on this page and still answers 200. A
total that exactly equals count on a full page is worth a second
look.
Request
Responses
- 200
- 401
- 403
- 404
- 500
One page of user summaries. A page past the end of the list, and a
tenant with no users at all, are both a 200 with an empty users
array.
Authentication failed: the X-API-Token header was missing, malformed,
expired or not recognised.
This response is text/plain, not JSON. It is written by
http.Error in the authentication middleware, which runs before any
handler and therefore before anything that would build a JSON envelope.
A client that unconditionally JSON-parses response bodies will fail on
this one, so check the status code first.
The token is valid, but it is not allowed to act on this tenant.
An API token is minted inside one tenant and stays bound to it for life.
Sending it to a path whose tenant segment names a different tenant is
refused here, in middleware, before the operation runs, so this says
nothing about the resource you asked for, only about which tenant the
path named. Check the tenant server variable against the console the
token was created in.
No tenant matches the tenant segment of the request path. Check the
tenant server variable rather than the query.
The users could not be read from the directory.