Sign in

v1

latestOpenAPI 3.1.0Elastic 2.02026-07-179371211.2 KB
Users

Get Users

Returns all SOC users.

get/connect/users

Response

List of user objects, or empty list if not permitted to view user list

createTimestring

The date and time that this user was created. This is a read-only field.

emailstring

The email address for this user.

firstNamestring

The user's first name.

idstring

The ID assigned to this user by the server. This is a read-only field.

lastNamestring

The user's last name, or family name.

notestring

A custom note about this user.

oidcStatusstring

The OIDC status for this user. This is a read-only field.

passwordstring

The password must have a length of at least 8 characters and no more than 72 characters and cannot contain the following: ' " $ \

passwordChangedboolean

A rough determination of whether this user has changed their password since the user was created. Technically this can only detect if the user has been updated after creation and is therefore an imperfect estimator for whether the password has been changed. This is a read-only field.

rolesstring[]

A list of assigned roles to this user.

searchUsernamestring

An alternate username (typically an email address) to use when performing backend (Ex: Elasticsearch) data searches and updates.

statusstring

The login status of this user.

totpStatusstring

The TOTP MFA status for this user. This is a read-only field.

updateTimestring

The date and time that this user was last modified. This is a read-only field.

webauthnStatusstring

The WebAuthn (Passwordless) status for this user. This status field is not ready for production use. This is a read-only field.

Example response

[
  {
    "createTime": "2024-11-14T15:03:22Z",
    "email": "someone@somewhere.invalid",
    "firstName": "John",
    "id": "3610b2cf-a2e7-4037-9c51-227f0c2e79ff",
    "lastName": "Smith",
    "note": "Employment terminated on Nov 10, 2023",
    "oidcStatus": "enabled",
    "roles": [
      "limited-analyst"
    ],
    "searchUsername": "someoneelse@somewhere.invalid",
    "status": "locked",
    "totpStatus": "enabled",
    "updateTime": "2024-11-14T15:33:02Z",
    "webauthnStatus": "enabled"
  }
]