Returns a page of the people in your organization, with the total so you can…

Returns a page of the people in your organization, with the total so you can page through the rest.

GET /v1/iam/users

IAM → · All API references → · Six flows, four surfaces →


Address	`https://api.hanzo.ai/v1/iam/users`
Method	`GET`
Operation	`get_iam_users`
Auth	`Authorization: Bearer $HANZO_API_KEY`

Returns a page of the people in your organization, with the total so you can page through the rest. Passwords, API secrets and MFA material are stripped from every entry.

Request

3 fields.

Field	In	Type	Required
`owner`	query	string	yes
`limit`	query	integer	—
`offset`	query	integer	—

Response

Status	Body	Meaning
`200`	iam.users.ListOutput	ok

200 body — 259 fields.

Field	In	Type	Always	Description
`total`	body	integer	—
`users`	body	iam.User[]	—
`users[].accessKey`	body	string	—	API credentials. AccessSecret / AccessSecretHash / the OAuth tokens are bearer material.
`users[].accessSecret`	body	string	—
`users[].accessSecretHash`	body	string	—
`users[].accessToken`	body	string	—
`users[].address`	body	string[]	—
`users[].addresses`	body	iam.Address[]	—
`users[].addresses[].city`	body	string	—
`users[].addresses[].line1`	body	string	—
`users[].addresses[].line2`	body	string	—
`users[].addresses[].region`	body	string	—
`users[].addresses[].state`	body	string	—
`users[].addresses[].tag`	body	string	—
`users[].addresses[].zipCode`	body	string	—
`users[].adfs`	body	string	—
`users[].affiliation`	body	string	—
`users[].alipay`	body	string	—
`users[].amazon`	body	string	—
`users[].apple`	body	string	—
`users[].applicationScopes`	body	iam.ConsentRecord[]	—
`users[].applicationScopes[].application`	body	string	—
`users[].applicationScopes[].grantedScopes`	body	string[]	—
`users[].auth0`	body	string	—
`users[].avatar`	body	string	—
`users[].avatarType`	body	string	—
`users[].azuread`	body	string	—
`users[].azureadb2c`	body	string	—
`users[].baidu`	body	string	—
`users[].balance`	body	number	—	Balance mirrors v1 for lossless migration but is authoritative in Commerce (billing.hanzo.ai), not here — do not write it from IAM.
`users[].balanceCredit`	body	number	—
`users[].balanceCurrency`	body	string	—
`users[].battlenet`	body	string	—
`users[].bilibili`	body	string	—
`users[].bio`	body	string	—
`users[].birthday`	body	string	—
`users[].bitbucket`	body	string	—
`users[].box`	body	string	—
`users[].cart`	body	iam.CartItem[]	—
`users[].cart[].displayName`	body	string	—
`users[].cart[].name`	body	string	—
`users[].cart[].owner`	body	string	—
`users[].cart[].price`	body	number	—
`users[].cart[].quantity`	body	integer	—
`users[].cloudfoundry`	body	string	—
`users[].countryCode`	body	string	—
`users[].createdAt`	body	string (date-time)	—
`users[].createdIp`	body	string	—	Sign-in provenance.
`users[].createdTime`	body	string	—
`users[].currency`	body	string	—
`users[].custom`	body	string	—
`users[].custom2`	body	string	—
`users[].custom3`	body	string	—
`users[].custom4`	body	string	—
`users[].custom5`	body	string	—
`users[].custom6`	body	string	—
`users[].custom7`	body	string	—
`users[].custom8`	body	string	—
`users[].custom9`	body	string	—
`users[].custom10`	body	string	—
`users[].dailymotion`	body	string	—
`users[].deezer`	body	string	—
`users[].deleted`	body	boolean	—
`users[].deletedTime`	body	string	—
`users[].digitalocean`	body	string	—
`users[].dingtalk`	body	string	—
`users[].discord`	body	string	—
`users[].displayName`	body	string	—	Profile.
`users[].douyin`	body	string	—
`users[].dropbox`	body	string	—
`users[].education`	body	string	—
`users[].email`	body	string	—
`users[].emailVerified`	body	boolean	—
`users[].eveonline`	body	string	—
`users[].externalId`	body	string	—
`users[].faceIds`	body	iam.FaceId[]	—
`users[].faceIds[].faceIdData`	body	number[]	—
`users[].faceIds[].imageUrl`	body	string	—
`users[].faceIds[].name`	body	string	—
`users[].facebook`	body	string	—
`users[].firstName`	body	string	—
`users[].fitbit`	body	string	—
`users[].gender`	body	string	—
`users[].gitea`	body	string	—
`users[].gitee`	body	string	—
`users[].github`	body	string	—	Linked federated-identity subjects, one column per connector (v1 parity).
`users[].gitlab`	body	string	—
`users[].google`	body	string	—
`users[].groups`	body	string[]	—
`users[].hash`	body	string	—
`users[].heroku`	body	string	—
`users[].homepage`	body	string	—
`users[].iam`	body	string	—
`users[].id`	body	string	—	Id is the user's STABLE OPAQUE identifier — the value the OIDC `sub` claim carries. It is the v1 the legacy surface per-row UUID (e.g.
`users[].idCard`	body	string	—
`users[].idCardType`	body	string	—
`users[].influxcloud`	body	string	—
`users[].infoflow`	body	string	—
`users[].instagram`	body	string	—
`users[].intercom`	body	string	—
`users[].invitation`	body	string	—
`users[].invitationCode`	body	string	—
`users[].ipWhitelist`	body	string	—
`users[].isAdmin`	body	boolean	—
`users[].isDefaultAvatar`	body	boolean	—	State flags.
`users[].isDeleted`	body	boolean	—
`users[].isForbidden`	body	boolean	—
`users[].isOnline`	body	boolean	—
`users[].isVerified`	body	boolean	—
`users[].kakao`	body	string	—
`users[].karma`	body	integer	—
`users[].kwai`	body	string	—
`users[].language`	body	string	—
`users[].lark`	body	string	—
`users[].lastChangePasswordTime`	body	string	—
`users[].lastName`	body	string	—
`users[].lastSigninIp`	body	string	—
`users[].lastSigninTime`	body	string	—
`users[].lastSigninWrongTime`	body	string	—
`users[].lastfm`	body	string	—
`users[].ldap`	body	string	—
`users[].line`	body	string	—
`users[].linkedin`	body	string	—
`users[].location`	body	string	—
`users[].mailru`	body	string	—
`users[].managedAccounts`	body	iam.ManagedAccount[]	—
`users[].managedAccounts[].application`	body	string	—
`users[].managedAccounts[].signinUrl`	body	string	—
`users[].managedAccounts[].username`	body	string	—
`users[].meetup`	body	string	—
`users[].mfaAccounts`	body	iam.MfaAccount[]	—
`users[].mfaAccounts[].accountName`	body	string	—
`users[].mfaAccounts[].issuer`	body	string	—
`users[].mfaAccounts[].origin`	body	string	—
`users[].mfaEmailEnabled`	body	boolean	—
`users[].mfaItems`	body	iam.MfaItem[]	—
`users[].mfaItems[].name`	body	string	—
`users[].mfaItems[].rule`	body	string	—
`users[].mfaPhoneEnabled`	body	boolean	—
`users[].mfaPushEnabled`	body	boolean	—
`users[].mfaPushProvider`	body	string	—
`users[].mfaPushReceiver`	body	string	—
`users[].mfaRadiusEnabled`	body	boolean	—
`users[].mfaRadiusProvider`	body	string	—
`users[].mfaRadiusUsername`	body	string	—
`users[].mfaRememberDeadline`	body	string	—
`users[].mfaRememberDigest`	body	string	—	MfaRememberDigest is the digest of the token held by the ONE browser the deadline above applies to.
`users[].microsoftonline`	body	string	—
`users[].multiFactorAuths`	body	iam.MfaProps[]	—
`users[].multiFactorAuths[].countryCode`	body	string	—
`users[].multiFactorAuths[].enabled`	body	boolean	—
`users[].multiFactorAuths[].isPreferred`	body	boolean	—
`users[].multiFactorAuths[].mfaRememberInHours`	body	integer	—
`users[].multiFactorAuths[].mfaType`	body	string	—
`users[].multiFactorAuths[].url`	body	string	—
`users[].name`	body	string	—
`users[].naver`	body	string	—
`users[].needUpdatePassword`	body	boolean	—
`users[].nextcloud`	body	string	—
`users[].okta`	body	string	—
`users[].onedrive`	body	string	—
`users[].originalRefreshToken`	body	string	—
`users[].originalToken`	body	string	—
`users[].oura`	body	string	—
`users[].owner`	body	string	—	Identity / tenancy.
`users[].passwordHash`	body	string	—	Credential material. PasswordHash is a one-way bcrypt digest and is verify-only.
`users[].passwordSalt`	body	string	—
`users[].passwordType`	body	string	—
`users[].patreon`	body	string	—
`users[].paypal`	body	string	—
`users[].permanentAvatar`	body	string	—
`users[].permissions`	body	iam.Permission[]	—
`users[].permissions[].actions`	body	string[]	—
`users[].permissions[].adapter`	body	string	—
`users[].permissions[].approveTime`	body	string	—
`users[].permissions[].approver`	body	string	—
`users[].permissions[].createdAt`	body	string (date-time)	—
`users[].permissions[].createdTime`	body	string	—	Descriptive metadata.
`users[].permissions[].deleted`	body	boolean	—
`users[].permissions[].description`	body	string	—
`users[].permissions[].displayName`	body	string	—
`users[].permissions[].domains`	body	string[]	—
`users[].permissions[].effect`	body	string	—
`users[].permissions[].groups`	body	string[]	—
`users[].permissions[].id`	body	string	—
`users[].permissions[].isEnabled`	body	boolean	—
`users[].permissions[].model`	body	string	—	Authorization model, targets, and decision.
`users[].permissions[].name`	body	string	—
`users[].permissions[].owner`	body	string	—	Identity — the (owner, name) natural key.
`users[].permissions[].resourceType`	body	string	—
`users[].permissions[].resources`	body	string[]	—
`users[].permissions[].roles`	body	string[]	—
`users[].permissions[].state`	body	string	—
`users[].permissions[].submitter`	body	string	—	Submission / approval workflow.
`users[].permissions[].updatedAt`	body	string (date-time)	—
`users[].permissions[].users`	body	string[]	—	Subjects the grant is evaluated for.
`users[].phone`	body	string	—
`users[].preHash`	body	string	—
`users[].preferredMfaType`	body	string	—
`users[].properties`	body	object	—
`users[].properties.*`	body	string	—
`users[].qq`	body	string	—
`users[].ranking`	body	integer	—
`users[].realName`	body	string	—
`users[].recoveryCodes`	body	string[]	—
`users[].region`	body	string	—
`users[].registerSource`	body	string	—
`users[].registerType`	body	string	—
`users[].roles`	body	iam.Role[]	—	Authorization attachments.
`users[].roles[].createdAt`	body	string (date-time)	—
`users[].roles[].createdTime`	body	string	—
`users[].roles[].deleted`	body	boolean	—
`users[].roles[].description`	body	string	—
`users[].roles[].displayName`	body	string	—
`users[].roles[].domains`	body	string[]	—
`users[].roles[].groups`	body	string[]	—
`users[].roles[].id`	body	string	—
`users[].roles[].isEnabled`	body	boolean	—
`users[].roles[].name`	body	string	—
`users[].roles[].owner`	body	string	—
`users[].roles[].roles`	body	string[]	—
`users[].roles[].updatedAt`	body	string (date-time)	—
`users[].roles[].users`	body	string[]	—
`users[].salesforce`	body	string	—
`users[].score`	body	integer	—
`users[].shopify`	body	string	—
`users[].signinWrongTimes`	body	integer	—
`users[].signupApplication`	body	string	—
`users[].slack`	body	string	—
`users[].soundcloud`	body	string	—
`users[].spotify`	body	string	—
`users[].steam`	body	string	—
`users[].strava`	body	string	—
`users[].stripe`	body	string	—
`users[].tag`	body	string	—
`users[].telegram`	body	string	—
`users[].tiktok`	body	string	—
`users[].title`	body	string	—
`users[].totpSecret`	body	string	—
`users[].tumblr`	body	string	—
`users[].twitch`	body	string	—
`users[].twitter`	body	string	—
`users[].type`	body	string	—
`users[].typetalk`	body	string	—
`users[].uber`	body	string	—
`users[].updatedAt`	body	string (date-time)	—
`users[].updatedTime`	body	string	—
`users[].verificationCode`	body	string	—
`users[].vk`	body	string	—
`users[].webauthnCredentials`	body	any[]	—	Multi-factor authentication. TotpSecret and RecoveryCodes are secret verify-only material — the handler strips them from every response.
`users[].wechat`	body	string	—
`users[].wecom`	body	string	—
`users[].weibo`	body	string	—
`users[].wepay`	body	string	—
`users[].xero`	body	string	—
`users[].yahoo`	body	string	—
`users[].yammer`	body	string	—
`users[].yandex`	body	string	—
`users[].zoom`	body	string	—

Failure carries the platform error shape — see Errors.

Examples

hanzo iam users get --owner <owner>

import { Configuration, IamApi } from 'hanzoai';

const api = new IamApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.getIamUsers({ owner: 'owner' });

from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import IamApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = IamApi(client).get_iam_users(owner='owner')

cfg := cloud.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := cloud.NewAPIClient(cfg)

resp, _, err := client.IamAPI.GetIamUsers(context.Background()).Execute()
if err != nil {
	return err
}

use hanzo_cloud::apis::{configuration::Configuration, iam_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = iam_api::get_iam_users(&cfg, Default::default()).await?;

import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.IamApi;

ApiClient client = new ApiClient();
client.setRequestInterceptor(b -> b.header("Authorization", "Bearer " + System.getenv("HANZO_API_KEY")));

var result = new IamApi(client).getIamUsers();

curl https://api.hanzo.ai/v1/iam/users?owner=%3Cowner%3E \
  -H "Authorization: Bearer $HANZO_API_KEY"

The door reaches iam through the iam tool, which names its 75 operations with its own verbs — this one among them, under a name only the door declares. describe explains any of them:

curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "describe",
         "arguments": {
           "op": "list__well_known_jwks"
         }
       }
     }'

IAM API · All Hanzo APIs · Interactive reference

Returns a page of the people in your organization, with the total so you can…

Request

Response

Examples

On this page