List all users

GET $BASE_URL/v1/users

Auth: Authorization: Bearer <accessToken> — an organization-scoped token from Authentication.

​

Query parameters

​

Filterable fields

In contains filters the comma is searched literally, and values below the minimum length return invalid_filter_value (400). Filtering on any other field returns invalid_filter_field (400).

​

Example

curl --request GET \
  --url "$BASE_URL/v1/users?f%5Bstatus%5D=1&limit=50" \
  --header 'Authorization: Bearer <accessToken>'

​

Response

{
  "data": [
    {
      "id": "fa000708-10f6-47ea-a35d-d3e1acbd4be5",
      "fullname": "Jane Cashier",
      "email": "jane@example.com",
      "phone": "+905321112233",
      "status": 1,
      "organization": "ca5495d7-36ee-4f6d-8149-0dd082f7c745",
      "branch": "377ec3ad-28c8-4008-b3df-005a434dcf8b",
      "authBranches": ["377ec3ad-28c8-4008-b3df-005a434dcf8b"],
      "roles": [
        { "id": "e5e94c4a-7ab7-4568-bf5d-4ea61c2300af", "code": "branch_user", "name": "Branch User" }
      ],
      "opaqueId": "pos-user-7",
      "createdAt": "2026-10-06T12:31:34.711Z",
      "updatedAt": "2026-10-06T12:32:10.618Z"
    }
  ],
  "meta": {
    "total": 4,
    "limit": 50
  }
}

• meta.total is the total record count for the current filter, independent of paging position; meta.cursor is the paging token for the next page and is omitted on the last page.
• organization, branch and authBranches are plain id strings.
• Optional fields that have no value (phone, branch, authBranches, opaqueId) are omitted — you will not receive null.
• roles contains only public-facing roles; internal system roles are not listed, so an empty roles array does not mean the user has no role.
• Credentials and internal account settings are never returned.
• Use GET /v1/users/:id to load a single user.