Skip to content
Docs
Users

List users

List users

client.Zones.Users.List(ctx, zoneID, query) (*ZoneUserListResponse, error)
GET/zones/{zoneId}/users

Returns a list of users in the specified zone.

Note: cursor pagination, search, and sort are not yet enabled for all zones. Where they are not enabled, the response returns all users in the zone (capped at 100) in items, with after_cursor and before_cursor set to null and total_count of 0; filter[email] and filter[identifier] are still applied, while the pagination, search, and sort parameters below are accepted but ignored.

Use cursor pagination via after/before. Sort: comma-separated field list; prefix with - for descending. Use expand[]=total_count to include the matching row count, expand[]=session_count to include per-user session counts, expand[]=grant_count to include per-user delegated-grant counts, expand[]=role-assignments to include each user's structured role grants (direct grants only by default, each tagged with source; use role_source=all to also include group-inherited), expand[]=groups to include each user's group memberships, expand[]=credentials to include each user's authentication credentials (each with its provider_id), and expand[]=credentials.provider to additionally inline the full identity provider on each federation credential. Filter by exact email via filter[email] and by exact identifier via filter[identifier]; restrict to members of a group via filter[groups] (repeatable, OR'd across values); search via query[email] / query[subject] / query[] (substring match, OR'd across repeated values). query[] matches against email and federation credential subject. Pass filter[id] (repeatable, max 100) to restrict results to a known set of users — mutually exclusive with after/before (returns 400 if combined). When filter[id] is set, limit is ignored and the response contains every requested user that exists in the zone, in a single page. IDs not in the zone are silently omitted.

ParametersExpand Collapse
zoneID string
query ZoneUserListParams
After param.Field[string]optional

Cursor for forward pagination

minLength1
maxLength255
Before param.Field[string]optional

Cursor for backward pagination

minLength1
maxLength255
Expand param.Field[ZoneUserListParamsExpandUnion]optional
type ZoneUserListParamsExpandString string
Accepts one of the following:
const ZoneUserListParamsExpandStringTotalCount ZoneUserListParamsExpandString = "total_count"
const ZoneUserListParamsExpandStringSessionCount ZoneUserListParamsExpandString = "session_count"
const ZoneUserListParamsExpandStringGrantCount ZoneUserListParamsExpandString = "grant_count"
const ZoneUserListParamsExpandStringRoleAssignments ZoneUserListParamsExpandString = "role-assignments"
const ZoneUserListParamsExpandStringGroups ZoneUserListParamsExpandString = "groups"
const ZoneUserListParamsExpandStringCredentials ZoneUserListParamsExpandString = "credentials"
const ZoneUserListParamsExpandStringCredentialsProvider ZoneUserListParamsExpandString = "credentials.provider"
type ZoneUserListParamsExpandArray []string
Accepts one of the following:
const ZoneUserListParamsExpandArrayItemTotalCount ZoneUserListParamsExpandArrayItem = "total_count"
const ZoneUserListParamsExpandArrayItemSessionCount ZoneUserListParamsExpandArrayItem = "session_count"
const ZoneUserListParamsExpandArrayItemGrantCount ZoneUserListParamsExpandArrayItem = "grant_count"
const ZoneUserListParamsExpandArrayItemRoleAssignments ZoneUserListParamsExpandArrayItem = "role-assignments"
const ZoneUserListParamsExpandArrayItemGroups ZoneUserListParamsExpandArrayItem = "groups"
const ZoneUserListParamsExpandArrayItemCredentials ZoneUserListParamsExpandArrayItem = "credentials"
const ZoneUserListParamsExpandArrayItemCredentialsProvider ZoneUserListParamsExpandArrayItem = "credentials.provider"
FilterEmail param.Field[ZoneUserListParamsFilterEmailUnion]optional

Filter by exact email address

string
type ZoneUserListParamsFilterEmailArray []string
FilterGroups param.Field[ZoneUserListParamsFilterGroupsUnion]optional

Restrict to members of this group (by group ID). Repeatable; OR'd across values.

string
type ZoneUserListParamsFilterGroupsArray []string
FilterID param.Field[ZoneUserListParamsFilterIDUnion]optional

Restrict results to users with this publicId. Repeatable, max 100. Mutually exclusive with after/before.

string
type ZoneUserListParamsFilterIDArray []string
FilterIdentifier param.Field[ZoneUserListParamsFilterIdentifierUnion]optional

Filter by exact user identifier

string
type ZoneUserListParamsFilterIdentifierArray []string
Limit param.Field[int64]optional

Maximum number of items to return

minimum1
maximum100
Query param.Field[ZoneUserListParamsQueryUnion]optional

Search across email and credential subject (substring match)

string
type ZoneUserListParamsQueryArray []string
QueryEmail param.Field[ZoneUserListParamsQueryEmailUnion]optional

Search by email (substring match)

string
type ZoneUserListParamsQueryEmailArray []string
QuerySubject param.Field[ZoneUserListParamsQuerySubjectUnion]optional

Search by federated credential subject (substring match)

string
type ZoneUserListParamsQuerySubjectArray []string
RoleSource param.Field[ZoneUserListParamsRoleSource]optional

Selects which grants expand[]=role-assignments returns, tagging each with source: user (direct only, the default), group (group-inherited only), or all (both direct and group-inherited). Requires expand[]=role-assignments.

const ZoneUserListParamsRoleSourceUser ZoneUserListParamsRoleSource = "user"
const ZoneUserListParamsRoleSourceGroup ZoneUserListParamsRoleSource = "group"
const ZoneUserListParamsRoleSourceAll ZoneUserListParamsRoleSource = "all"
Sort param.Field[string]optional

Comma-separated sort fields. Prefix with - for descending. Allowed: created_at, email, authenticated_at

ReturnsExpand Collapse
type ZoneUserListResponse struct{…}
Items []User
ID string

Unique identifier of the user

CreatedAt Time

Entity creation timestamp

formatdate-time
Email string

Email address of the user

formatemail
EmailVerified bool

Whether the email address has been verified

Identifier string

Zone-scoped user identifier. Defaults to the user's Keycard ID. When the provider has user_identifier_claim configured, the value is set from that claim at user creation time.

OrganizationID string

Organization that owns this user

Status UserStatus

Status of the user. Disabled users cannot authenticate.

Accepts one of the following:
const UserStatusActive UserStatus = "active"
const UserStatusDisabled UserStatus = "disabled"
UpdatedAt Time

Entity update timestamp

formatdate-time
ZoneID string

Zone this user belongs to

AuthenticatedAt stringoptional

Date when the user was last authenticated

Credentials []UserCredentialUnionoptional

Authentication credentials for this user, each carrying its identity provider for federation credentials. Populated only when expand[]=credentials is set on the listing endpoint.

Accepts one of the following:
type UserCredentialUserCredentialFederation struct{…}

Federation credential: the user authenticates through an identity provider.

CreatedAt Time

Entity creation timestamp

formatdate-time
ProviderID string

ID of the identity provider backing this credential. null when the source provider has been deleted.

Type string
UpdatedAt Time

Entity update timestamp

formatdate-time
Issuer stringoptional

Issuer identifier of the identity provider.

Provider Provideroptional

A Provider is a system that supplies access to Resources and allows actors (Users or Applications) to authenticate.

ID string

Unique identifier of the provider

CreatedAt Time

Entity creation timestamp

formatdate-time
Identifier string

User specified identifier, unique within the zone

minLength1
maxLength2048
Name string

Human-readable name

minLength1
maxLength255
OrganizationID string

Organization that owns this provider

OwnerType ProviderOwnerType

Who owns this provider. Platform-owned providers cannot be modified via API.

Accepts one of the following:
const ProviderOwnerTypePlatform ProviderOwnerType = "platform"
const ProviderOwnerTypeCustomer ProviderOwnerType = "customer"
Slug string

URL-safe identifier, unique within the zone

minLength1
maxLength63
UpdatedAt Time

Entity update timestamp

formatdate-time
ZoneID string

Zone this provider belongs to

ClientID stringoptional

OAuth 2.0 client identifier

ClientSecretSet booloptional

Indicates whether a client secret is configured

Description stringoptional

Human-readable description

maxLength2048
Metadata ProviderMetadataoptional

Provider metadata

IconURL stringoptional

Icon URL

formaturi
maxLength2048
Protocols ProviderProtocolsoptional

Protocol-specific configuration

Oauth2 ProviderProtocolsOauth2optional

OAuth 2.0 protocol configuration

Issuer string

OIDC issuer URL used for discovery and token validation.

formaturi
AuthorizationEndpoint stringoptional
formaturi
AuthorizationParameters map[string, string]optional

Custom query parameters appended to authorization redirect URLs. Use for non-standard providers (e.g. Google prompt=consent, access_type=offline).

AuthorizationResourceEnabled booloptional

Whether to include the resource parameter in authorization requests.

AuthorizationResourceParameter stringoptional

The resource parameter value to include in authorization requests. Defaults to "resource" when authorization_resource_enabled is true.

CodeChallengeMethodsSupported []stringoptional
JwksUri stringoptional
formaturi
RegistrationEndpoint stringoptional
formaturi
ScopeParameter stringoptional

The query parameter name for scopes in authorization requests. Defaults to "scope". Slack v2 uses "user_scope".

ScopeSeparator stringoptional

The separator character for scope values. Defaults to " " (space). Slack v2 uses ",".

ScopesSupported []stringoptional
TokenEndpoint stringoptional
formaturi
TokenResponseAccessTokenPointer stringoptional

Dot-separated path to the access token in the token response body. Defaults to "access_token". Slack v2 uses "authed_user.access_token".

Openid ProviderProtocolsOpenidoptional

OpenID Connect protocol configuration

ExternalIDClaim stringoptional

Name of the OIDC claim carrying the stable external id used to correlate logins with externally provisioned (SCIM) users. Defaults to "sub". Set to "oid" for Entra, whose pairwise "sub" differs from the SCIM externalId.

Scopes []stringoptional

Additional OIDC scopes to request from this provider during authentication (e.g. "groups"). Merged with the default scopes (openid, profile, email).

SingleLogoutEnabled booloptional

When true, logging out of the zone propagates the logout to this provider's end_session_endpoint (RP-initiated logout). Defaults to false.

UserIdentifierClaim stringoptional

Name of a top-level string claim in this provider's ID Token to use as the user identifier on user creation. When not set, the user's Keycard ID is used.

UserinfoEndpoint stringoptional
formaturi
Type ProviderTypeoptional
Accepts one of the following:
const ProviderTypeExternal ProviderType = "external"
const ProviderTypeKeycardVault ProviderType = "keycard-vault"
const ProviderTypeKeycardSts ProviderType = "keycard-sts"
Subject stringoptional

Subject identifier from the identity provider.

type UserCredentialUserCredentialPassword struct{…}

Password credential: the user authenticates with email and password. The email lives on the user.

CreatedAt Time

Entity creation timestamp

formatdate-time
Type string
UpdatedAt Time

Entity update timestamp

formatdate-time
GrantCount int64optional

Delegated-grant count for this user. Populated only when expand[]=grant_count is set on the listing endpoint.

minimum0
Groups []UserGroupoptional

Groups this user belongs to within the zone. Populated only when expand[]=groups is set on the listing endpoint.

ID string

Unique identifier of the group

Identifier string

Zone-unique slug that policy rules match on.

Name string

Human-readable group name

Issuer stringoptional

Issuer identifier of the identity provider

ProviderID stringoptional

Reference to the identity provider. This field is undefined when the source identity provider is deleted but the user is not deleted.

RoleAssignments []UserRoleAssignmentoptional

Role grants for this user within the zone. Populated only when expand[]=role-assignments is set on the listing endpoint.

RoleID string

ID of the assigned role

RoleIdentifier string

Role identifier: a lowercase slug (letters and digits separated by single hyphens or underscores), unique per owner type within a zone. Role identifiers surface in policy evaluation, so the slug restriction keeps them unambiguous in policy text.

minLength1
maxLength255
RoleOwnerType string

Owner type of the granted role. Disambiguates roles that share an identifier across owner types.

Accepts one of the following:
const UserRoleAssignmentRoleOwnerTypePlatform UserRoleAssignmentRoleOwnerType = "platform"
const UserRoleAssignmentRoleOwnerTypeCustomer UserRoleAssignmentRoleOwnerType = "customer"
Scope UserRoleAssignmentScope

The resource this grant is scoped to, or null when the grant is unscoped (applies to the owning zone itself).

ID string

The ID of the scoped resource.

Type string

The kind of resource this grant is scoped to (e.g. zone).

Source string

The principal that holds this grant: user when assigned directly to the user, or group when inherited through group membership.

Accepts one of the following:
const UserRoleAssignmentSourceUser UserRoleAssignmentSource = "user"
const UserRoleAssignmentSourceGroup UserRoleAssignmentSource = "group"
GroupID stringoptional

ID of the group this grant is inherited from. Present only when source is group.

SessionCount int64optional

Session count for this user. Populated only when expand[]=session_count is set on the listing endpoint.

minimum0
Subject stringoptional

Subject identifier from the identity provider

List users

package main

import (
  "context"
  "fmt"

  "github.com/keycardai/keycard-go"
  "github.com/keycardai/keycard-go/option"
)

func main() {
  client := keycard.NewClient(
    option.WithAPIKey("My API Key"),
  )
  users, err := client.Zones.Users.List(
    context.TODO(),
    "zoneId",
    keycard.ZoneUserListParams{

    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", users.Items)
}
{
  "items": [
    {
      "id": "id",
      "created_at": "2019-12-27T18:11:19.117Z",
      "email": "dev@stainless.com",
      "email_verified": true,
      "identifier": "identifier",
      "organization_id": "organization_id",
      "status": "active",
      "updated_at": "2019-12-27T18:11:19.117Z",
      "zone_id": "zone_id",
      "authenticated_at": "authenticated_at",
      "credentials": [
        {
          "created_at": "2019-12-27T18:11:19.117Z",
          "provider_id": "provider_id",
          "type": "federation",
          "updated_at": "2019-12-27T18:11:19.117Z",
          "issuer": "issuer",
          "provider": {
            "id": "id",
            "created_at": "2019-12-27T18:11:19.117Z",
            "identifier": "x",
            "name": "x",
            "organization_id": "organization_id",
            "owner_type": "platform",
            "slug": "slug",
            "updated_at": "2019-12-27T18:11:19.117Z",
            "zone_id": "zone_id",
            "client_id": "client_id",
            "client_secret_set": true,
            "description": "description",
            "metadata": {
              "icon_url": "https://example.com"
            },
            "protocols": {
              "oauth2": {
                "issuer": "https://example.com",
                "authorization_endpoint": "https://example.com",
                "authorization_parameters": {
                  "foo": "string"
                },
                "authorization_resource_enabled": true,
                "authorization_resource_parameter": "authorization_resource_parameter",
                "code_challenge_methods_supported": [
                  "string"
                ],
                "jwks_uri": "https://example.com",
                "registration_endpoint": "https://example.com",
                "scope_parameter": "scope_parameter",
                "scope_separator": "scope_separator",
                "scopes_supported": [
                  "string"
                ],
                "token_endpoint": "https://example.com",
                "token_response_access_token_pointer": "token_response_access_token_pointer"
              },
              "openid": {
                "external_id_claim": "external_id_claim",
                "scopes": [
                  "string"
                ],
                "single_logout_enabled": true,
                "user_identifier_claim": "user_identifier_claim",
                "userinfo_endpoint": "https://example.com"
              }
            },
            "type": "external"
          },
          "subject": "subject"
        }
      ],
      "grant_count": 0,
      "groups": [
        {
          "id": "id",
          "identifier": "identifier",
          "name": "name"
        }
      ],
      "issuer": "issuer",
      "provider_id": "provider_id",
      "role_assignments": [
        {
          "role_id": "role_id",
          "role_identifier": "role_identifier",
          "role_owner_type": "platform",
          "scope": {
            "id": "id",
            "type": "type"
          },
          "source": "user",
          "group_id": "group_id"
        }
      ],
      "session_count": 0,
      "subject": "subject"
    }
  ],
  "pagination": {
    "after_cursor": "x",
    "before_cursor": "x",
    "total_count": 0
  }
}
Returns Examples
{
  "items": [
    {
      "id": "id",
      "created_at": "2019-12-27T18:11:19.117Z",
      "email": "dev@stainless.com",
      "email_verified": true,
      "identifier": "identifier",
      "organization_id": "organization_id",
      "status": "active",
      "updated_at": "2019-12-27T18:11:19.117Z",
      "zone_id": "zone_id",
      "authenticated_at": "authenticated_at",
      "credentials": [
        {
          "created_at": "2019-12-27T18:11:19.117Z",
          "provider_id": "provider_id",
          "type": "federation",
          "updated_at": "2019-12-27T18:11:19.117Z",
          "issuer": "issuer",
          "provider": {
            "id": "id",
            "created_at": "2019-12-27T18:11:19.117Z",
            "identifier": "x",
            "name": "x",
            "organization_id": "organization_id",
            "owner_type": "platform",
            "slug": "slug",
            "updated_at": "2019-12-27T18:11:19.117Z",
            "zone_id": "zone_id",
            "client_id": "client_id",
            "client_secret_set": true,
            "description": "description",
            "metadata": {
              "icon_url": "https://example.com"
            },
            "protocols": {
              "oauth2": {
                "issuer": "https://example.com",
                "authorization_endpoint": "https://example.com",
                "authorization_parameters": {
                  "foo": "string"
                },
                "authorization_resource_enabled": true,
                "authorization_resource_parameter": "authorization_resource_parameter",
                "code_challenge_methods_supported": [
                  "string"
                ],
                "jwks_uri": "https://example.com",
                "registration_endpoint": "https://example.com",
                "scope_parameter": "scope_parameter",
                "scope_separator": "scope_separator",
                "scopes_supported": [
                  "string"
                ],
                "token_endpoint": "https://example.com",
                "token_response_access_token_pointer": "token_response_access_token_pointer"
              },
              "openid": {
                "external_id_claim": "external_id_claim",
                "scopes": [
                  "string"
                ],
                "single_logout_enabled": true,
                "user_identifier_claim": "user_identifier_claim",
                "userinfo_endpoint": "https://example.com"
              }
            },
            "type": "external"
          },
          "subject": "subject"
        }
      ],
      "grant_count": 0,
      "groups": [
        {
          "id": "id",
          "identifier": "identifier",
          "name": "name"
        }
      ],
      "issuer": "issuer",
      "provider_id": "provider_id",
      "role_assignments": [
        {
          "role_id": "role_id",
          "role_identifier": "role_identifier",
          "role_owner_type": "platform",
          "scope": {
            "id": "id",
            "type": "type"
          },
          "source": "user",
          "group_id": "group_id"
        }
      ],
      "session_count": 0,
      "subject": "subject"
    }
  ],
  "pagination": {
    "after_cursor": "x",
    "before_cursor": "x",
    "total_count": 0
  }
}