List principals

GET

/principals

const url = 'https://example.com/api/v1/principals?kind=human';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'https://example.com/api/v1/principals?kind=human'

Lists all principals (humans and service accounts) with their grants. Gated by principal:read:admin.

Parameters

Query Parameters

kind

Optionally filter by principal kind

string

Allowed values: human service

Optionally filter by principal kind

include_archived

Include archived (soft-deleted) principals, hidden by default

boolean

Include archived (soft-deleted) principals, hidden by default

Responses

200

application/json

object

$schema

A URL to the JSON Schema for this object.

string format: uri

principals

required

Array<object> | null

object

$schema

A URL to the JSON Schema for this object.

string format: uri

active

required

boolean

archived_at

Set when the principal is archived (soft-deleted); absent means live

string format: date-time

grants

required

Array<object> | null

object

$schema

A URL to the JSON Schema for this object.

string format: uri

group_id

Set when this grant is inherited from a group the principal belongs to (the group’s id); absent for a direct grant, which is the only kind revocable from the principal.

string

group_name

The source group’s label, present when the grant is inherited.

string

role

required

string

scope_id

string

scope_kind

required

string

scope_op

How the scope root matches the tree: subtree (root + descendants), subtree_excl_root (descendants only for update/delete, root kept for read/create), or self (the root row only). Empty means subtree. Moot for the all scope.

string

Allowed values: subtree subtree_excl_root self

groups

required

Array<object> | null

object

required

string

name

required

string

human

object

$schema

A URL to the JSON Schema for this object.

string format: uri

display_name

string

email

string

has_avatar

True when the principal has a profile picture; fetch it from the avatar endpoint.

boolean

must_change_password

True when an admin reset the password and the user must change it before doing anything else; the console gates every route to the change-password form until it clears.

boolean

username

required

string

required

string

kind

required

string

service

object

label

required

string

Example

{
  "$schema": "/api/v1/schemas/ListPrincipalsOutputBody.json",
  "principals": [
    {
      "$schema": "/api/v1/schemas/PrincipalBody.json",
      "grants": [
        {
          "$schema": "/api/v1/schemas/GrantBody.json",
          "scope_op": "subtree"
        }
      ],
      "human": {
        "$schema": "/api/v1/schemas/HumanBody.json"
      }
    }
  ]
}

default

Error

application/problem+json

object

$schema

A URL to the JSON Schema for this object.

string format: uri

detail

A human-readable explanation specific to this occurrence of the problem.

string

errors

Optional list of individual error details

Array<object> | null

object

location

Where the error occurred, e.g. ‘body.items[3].tags’ or ‘path.thing-id’

string

message

Error message text

string

value

The value at the given location

instance

A URI reference that identifies the specific occurrence of the problem.

string format: uri

status

HTTP status code

integer format: int64

title

A short, human-readable summary of the problem type. This value should not change between occurrences of the error.

string

type

A URI reference to human-readable documentation for the error.

string format: uri

default: about:blank

Example

{
  "$schema": "/api/v1/schemas/ErrorModel.json",
  "detail": "Property foo is required but is missing.",
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "about:blank"
}