# List users (/docs/apis/management/users/GetAllUsers)

`GET /users`

Retrieves a paginated list of users. Optional query parameters allow searching, filtering, and sorting the results.

Base URL: `https://{tenant}.{region}.monocloud.com/api`, where `{tenant}`, `{region}` (one of us, eu, in) come from your tenant. Authentication: send your Management API key in the `X-API-KEY` header.

## Parameters

- `page` (query) (integer, int32, default 1) The page number to retrieve.
- `size` (query) (integer, int32, default 10) The number of users to return per page.
- `filter` (query) (string) Optional Lucene-style filter expression used to search by attributes.
- `sort` (query) (string) Sort expression in the format `field:direction`, where direction is `1` for ascending or `-1` for descending. Supported fields include - `failure_count`, `last_sign_in_attempt`, `sign_in_attempts_count`, `last_sign_in_success`, `sign_in_success_count`, `last_activity`, `block_until`, `creation_time`, `last_updated`.

## Response body

`200`, JSON. The users were retrieved successfully

Returns `UserSummary[]`. Each item has these fields:

- `user_id` (string, required) The unique identifier of the user.
- `disabled` (boolean, required) Indicates whether the account has been disabled.
- `claims` (Record<string, any>, required) Claims associated with the user.
- `emails` (UserEmail[], required) List of registered emails of the user.
  - `id` (string, required, uuid) Unique identifier of the user's email.
  - `primary` (boolean, required) Indicates whether this is the primary email address for the user.
  - `verified` (boolean, required) Indicates whether the email address has been verified.
  - `source` (string) Source from which the email address was originally collected.
  - `verification_source` (string) Identity provider or service that verified the email address.
  - `email` (string, required) The email address.
- `phone_numbers` (UserPhone[], required) List of registered phones of the user.
  - `id` (string, required, uuid) Unique identifier of the user's phone.
  - `primary` (boolean, required) Indicates whether this is the primary phone number for the user.
  - `verified` (boolean, required) Indicates whether the phone number has been verified.
  - `source` (string) Source from which the phone number was originally collected.
  - `verification_source` (string) Identity provider or service that verified the phone number.
  - `phone` (string, required) The phone number.
- `passkeys` (UserPasskey[], required) List of registered passkeys of the user.
  - `name` (string) Human-readable name assigned to the passkey.
  - `passkey_id` (string, required) Unique identifier of the passkey as provided by the authenticator.
  - `public_key` (string, required) Public key material associated with the passkey.
  - `aa_guid` (string, required, uuid) Authenticator Attestation GUID (AAGUID) identifying the authenticator model.
  - `backup_state` (boolean, required) Indicates whether the passkey is currently backed up by the authenticator.
  - `backup_eligibility` (boolean, required) Indicates whether the passkey is eligible for backup and multi-device use.
  - `user_present` (boolean, required) Indicates whether user presence was verified during passkey authentication.
  - `user_verified` (boolean, required) Indicates whether user verification (such as biometrics or PIN) was performed during authentication.
  - `user_agent` (string, required) User agent of the device used to register the passkey.
- `force_password_reset` (boolean, required) A flag indicating whether the user must change their password on next sign-in.
- `external_providers` (UserExternalProviderSummary[], required) External provider profiles linked to this user.
  - `provider` (string, required) The provider associated with this connection.
  - `authenticator` (string, required) The authenticator used by the provider. One of: `google`, `apple`, `facebook`, `microsoft`, `github`, `gitlab`, `discord`, `twitter`, `linkedin`, `xero`, `custom_oidc`, `custom_enterprise`, `entra_oidc`.
  - `provider_user_id` (string, required) The user identifier assigned by the identity provider.
- `creation_time` (integer, required, date-time) Specifies the creation time of the user (in Epoch).
- `last_updated` (integer, required, date-time) Specifies the last update time of the user (in Epoch).
- `username` (UserUsername) Registered username for the user.
  - `id` (string, required, uuid) Unique identifier of the user's username.
  - `username` (string, required) The username used to identify the user.
  - `source` (string) Source from which the username was originally collected.
- `has_password` (boolean, required) Indicates whether the user has a password set.
- `password_updated_at` (integer, date-time) Specifies the time of the last password update (in Epoch).
- `block_until` (integer, int64) Specifies the time at which the user will be unblocked (in Epoch).
- `failure_count` (integer, required, int32) Consecutive sign-in failures since the last successful sign-in.
- `sign_in_attempts_count` (integer, required, int32) Total sign-in attempts recorded for the user.
- `last_sign_in_attempt` (integer, date-time) Specifies the time of the last sign-in attempt (in Epoch).
- `last_sign_in_attempt_ip` (string) IP address of the last sign-in attempt.
- `sign_in_success_count` (integer, required, int32) Total successful sign-ins recorded for the user.
- `last_sign_in_success` (integer, date-time) Specifies the time of the last successful sign-in (in Epoch).
- `last_sign_in_success_ip` (string) IP address of the last successful sign-in.
- `last_activity` (integer, date-time) Specifies the time of the last recorded user activity (in Epoch).
- `last_known_city` (string) Last recorded city for the user.
- `last_known_country` (string) Last recorded country for the user.
- `last_known_region` (string) Last recorded region for the user.

## Errors

- `400` Bad Request
  - `type` (string, required) A URI reference that identifies the error type. When accessed, it may provide human-readable documentation.
  - `title` (string, required) A short, human-readable summary of the error.
  - `status` (integer, required, int32) The HTTP status code associated with this error response.
  - `trace_id` (string, required) A unique identifier for the request, used for tracing and diagnostics.
  - `detail` (string) A human-readable explanation specific to this occurrence of the error.
  - `instance` (string) A URI reference that identifies the specific occurrence of the error.
- `401` Unauthorized
- `403` Forbidden

## Example (MonoCloud .NET SDK)

```csharp
using MonoCloud.Management;
using MonoCloud.Management.Core.Base;

var apiClient = new MonoCloudManagementClient(new MonoCloudConfig("<your-domain>", "[[API-Key]]"));


var page = 1;

var size = 10;

var filter = "(name:bob OR email:bob@example.com)";

var sort = "creation_time:1";


var result = await apiClient.Users.GetAllUsersAsync(page, size, filter, sort);
```

## Example (MonoCloud Javascript SDK)

```javascript
import { MonoCloudManagementClient } from '@monocloud/management';

const apiClient = MonoCloudManagementClient.init({ domain: '<your-domain>', apiKey: '[[API-Key]]' });

const page = 1;

const size = 10;

const filter = '(name:bob OR email:bob@example.com)';

const sort = 'creation_time:1';

const result = apiClient.users.getAllUsers(page, size, filter, sort);
```