v13

latestOpenAPI 3.0.3MITraw.githubusercontent.com2026-08-04237161688.6 KB
Users

List all users

Returns a list of all users. The users are returned sorted by creation date, with the newest users appearing first.

get/users

Query parameters

email_addressstring[]

Returns users with the specified email addresses. Accepts up to 100 email addresses. Any email addresses not found are ignored.

phone_numberstring[]

Returns users with the specified phone numbers. Accepts up to 100 phone numbers. Any phone numbers not found are ignored.

external_idstring[]

Returns users with the specified external IDs. For each external ID, the + and - can be prepended to the ID, which denote whether the respective external ID should be included or excluded from the result set. Accepts up to 100 external IDs. Any external IDs not found are ignored.

usernamestring[]

Returns users with the specified usernames. Accepts up to 100 usernames. Any usernames not found are ignored.

web3_walletstring[]

Returns users with the specified web3 wallet addresses. Accepts up to 100 web3 wallet addresses. Any web3 wallet addresses not found are ignored.

user_idstring[]

Returns users with the user IDs specified. For each user ID, the + and - can be prepended to the ID, which denote whether the respective user ID should be included or excluded from the result set. Accepts up to 100 user IDs. Any user IDs not found are ignored.

organization_idstring[]

Returns users that have memberships to the given organizations. For each organization ID, the + and - can be prepended to the ID, which denote whether the respective organization should be included or excluded from the result set. Accepts up to 100 organization IDs.

querystring

Returns users that match the given query. For possible matches, we check the email addresses, phone numbers, usernames, web3 wallets, user IDs, first and last names. The query value doesn't need to match the exact value you are looking for, it is capable of partial matches as well.

email_address_querystring

Returns users with emails that match the given query, via case-insensitive partial match. For example, email_address_query=ello will match a user with the email HELLO@example.com.

phone_number_querystring

Returns users with phone numbers that match the given query, via case-insensitive partial match. For example, phone_number_query=555 will match a user with the phone number +1555xxxxxxx.

username_querystring

Returns users with usernames that match the given query, via case-insensitive partial match. For example, username_query=CoolUser will match a user with the username SomeCoolUser.

name_querystring

Returns users with names that match the given query, via case-insensitive partial match.

bannedboolean

Returns users which are either banned (banned=true) or not banned (banned=false).

last_active_at_beforeinteger

Returns users whose last session activity was before the given date (with millisecond precision). Example: use 1700690400000 to retrieve users whose last session activity was before 2023-11-23.

last_active_at_afterinteger

Returns users whose last session activity was after the given date (with millisecond precision). Example: use 1700690400000 to retrieve users whose last session activity was after 2023-11-23.

last_active_at_sinceinteger

Returns users that had session activity since the given date. Example: use 1700690400000 to retrieve users that had session activity from 2023-11-23 until the current day. Deprecated in favor of last_active_at_after.

created_at_beforeinteger

Returns users who have been created before the given date (with millisecond precision). Example: use 1730160000000 to retrieve users who have been created before 2024-10-29.

created_at_afterinteger

Returns users who have been created after the given date (with millisecond precision). Example: use 1730160000000 to retrieve users who have been created after 2024-10-29.

last_sign_in_at_beforeinteger

Returns users whose last sign-in was before the given date (with millisecond precision). Example: use 1700690400000 to retrieve users whose last sign-in was before 2023-11-23.

last_sign_in_at_afterinteger

Returns users whose last sign-in was after the given date (with millisecond precision). Example: use 1700690400000 to retrieve users whose last sign-in was after 2023-11-23.

providerstring

Returns users with external accounts for the specified OAuth provider. Must be used in combination with the provider_user_id parameter. For example, use provider=oauth_google&provider_user_id=12345 to retrieve a user with Google provider user ID 12345.

provider_user_idstring[]

Returns users with the specified provider user IDs for a specific provider. Must be used in combination with the provider parameter. For example, use provider=oauth_google&provider_user_id=12345 to retrieve a user with Google provider user ID 12345. Accepts up to 100 provider user IDs. Any provider user IDs not found are ignored.

limitinteger

Applies a limit to the number of results returned. Can be used for paginating the results together with offset.

offsetinteger

Skip the first offset results when paginating. Needs to be an integer greater or equal to zero. To be used in conjunction with limit.

order_bystring

Allows to return users in a particular order. At the moment, you can order the returned users by their created_at,updated_at,email_address,web3wallet,first_name,last_name,phone_number,username,last_active_at,last_sign_in_at. In order to specify the direction, you can use the +/- symbols prepended in the property to order by. For example, if you want users to be returned in descending order according to their created_at property, you can use -created_at. If you don't use + or -, then + is implied. We only support one order_by parameter, and if multiple order_by parameters are provided, we will only keep the first one. For example, if you pass order_by=username&order_by=created_at, we will consider only the first order_by parameter, which is username. The created_at parameter will be ignored in this case.

Response

Success

idstring required
object'user' required

String representing the object's type. Objects of the same type share the same value.

external_idstring nullable required
primary_email_address_idstring nullable required
primary_phone_number_idstring nullable required
primary_web3_wallet_idstring nullable required
usernamestring nullable required
first_namestring nullable required
last_namestring nullable required
localestring nullable
profile_image_urlstring
image_urlstring
has_imageboolean required
public_metadataobject required
private_metadataobject nullable
unsafe_metadataobject
password_enabledboolean required
two_factor_enabledboolean required
totp_enabledboolean required
backup_code_enabledboolean required
mfa_enabled_atinteger nullable required

Unix timestamp of when MFA was last enabled for this user. It should be noted that this field is not nullified if MFA is disabled.

mfa_disabled_atinteger nullable required

Unix timestamp of when MFA was last disabled for this user. It should be noted that this field is not nullified if MFA is enabled again.

password_last_updated_atinteger nullable

Unix timestamp of when the user's password was last updated.

last_sign_in_atinteger nullable required

Unix timestamp of last sign-in.

bannedboolean required

Flag to denote whether user is banned or not.

lockedboolean required

Flag to denote whether user is currently locked, i.e. restricted from signing in or not.

deprovisionedboolean

Flag to denote whether user has been deprovisioned and is restricted from signing in.

lockout_expires_in_secondsinteger nullable required

The number of seconds remaining until the lockout period expires for a locked user. A null value for a locked user indicates that lockout never expires.

verification_attempts_remaininginteger nullable required

The number of verification attempts remaining until the user is locked. Null if account lockout is not enabled. Note: if a user is locked explicitly via the Backend API, they may still have verification attempts remaining.

updated_atinteger required

Unix timestamp of last update.

created_atinteger required

Unix timestamp of creation.

delete_self_enabledboolean required

If enabled, user can delete themselves via FAPI.

create_organization_enabledboolean required

If enabled, user can create organizations via FAPI.

create_organizations_limitinteger nullable

The maximum number of organizations the user can create. 0 means unlimited.

last_active_atinteger nullable required

Unix timestamp of the latest session activity, with day precision.

legal_accepted_atinteger nullable required

Unix timestamp of when the user accepted the legal requirements.

bypass_client_trustboolean

When set to true, the user will bypass client trust checks during sign-in.

Example response

[
  {
    "last_active_at": 1700690400000,
    "legal_accepted_at": 1700690400000
  }
]