# List users

> Source: https://docs.clonepartner.com/api-reference/users/list-users/

`GET /api/users`

Requires admin or superadmin role.

**Operation ID:** `listUsers`

## Authentication

### Option 1

- **BearerAuth** (`http bearer`)
  API key token. Create via POST /api/api-keys. Format: `envoy_<hex>`

### Option 2

- **CookieAuth** (`apiKey`)
  Session cookie set after login + TOTP verification

## Query parameters

- `cursor` — `string`
  Pagination cursor from a previous response
- `limit` — `integer`
  Maximum number of results to return
  Example: `50`
  - Default: `50`
  - Maximum: 200
- `sort` — `string`
  Column name to sort by (validated per-entity)
- `order` — `string`
  Sort direction
  Example: `desc`
  - Allowed values: `asc`, `desc`
  - Default: `desc`
- `q` — `string`
  Case-insensitive search across name/description fields
- `role` — `string`
  Filter by role
  - Allowed values: `superadmin`, `admin`, `viewer`

## Success responses

### 200

Paginated list of users

**Content type:** `application/json`

- Type: `PaginatedResult & object`
- All of:
  - Variant 1:
    - Reference: `PaginatedResult`
      - Type: `object`
      - Properties:
        - `result` (`array<unknown>`)
          - Items:
            - Type: `unknown`
        - `nextCursor` (`string | null`)
          - Nullable: yes
        - `prevCursor` (`string | null`)
          - Nullable: yes
        - `total` (`integer`) — Total number of records matching the current filters
  - Variant 2:
    - Type: `object`
    - Properties:
      - `result` (`array<UserSafe>`)
        - Items:
          - Reference: `UserSafe`
            - Type: `object`
            - Properties:
              - `id` (`integer`)
              - `username` (`string`)
              - `role` (`string`)
                - Allowed values: `superadmin`, `admin`, `viewer`
              - `totp_verified` (`integer`)
                - Allowed values: `0`, `1`
              - `invite_pending` (`boolean`)
              - `created_at` (`string`)
                - Format: `date-time`
              - `updated_at` (`string`)
                - Format: `date-time`

## Error responses

### 403

Insufficient permissions


## Examples

### cURL

```bash
curl --request GET \
  --url 'https://your-envoy.example.com/api/users?cursor=YOUR_CURSOR&limit=50' \
  --header 'Authorization: Bearer $API_KEY'
```

### JavaScript (fetch)

```javascript
const response = await fetch('https://your-envoy.example.com/api/users?cursor=YOUR_CURSOR&limit=50', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer YOUR_API_KEY',
  },
});

if (!response.ok) throw new Error(`Request failed: ${response.status}`);
const data = response.status === 204 ? null : await response.json();
console.log(data);
```