> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bluee.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# List users in the administrator's organization

> Includes active, suspended, and access-removed users so historical ownership remains visible.



## OpenAPI

````yaml /openapi/next.yaml get /admin/users
openapi: 3.1.0
info:
  title: Blue — Service Contract
  version: 0.1.0
  description: >
    The client-side contract the `blue` CLI expects from the provisioned
    service. The reference `control-api` implements it; any BYO service that
    honors these shapes can be swapped in. Gateway-mode inference JWT issuance
    is OPTIONAL — governance-only deployments need only `GET
    /governance-config`. CLI callers use OAuth 2.0 access tokens issued through
    RFC 8628 device authorization; dashboard callers use an HTTP-only Better
    Auth session cookie.
servers:
  - url: https://harness.example.com
    description: Replace with the Control API URL for your deployment.
security:
  - oauthDevice: []
tags:
  - name: System
    description: Service health and authenticated identity.
  - name: Configuration
    description: Personalized governance policy and client reconciliation state.
  - name: Gateway
    description: Per-user managed inference-gateway credential lifecycle.
  - name: Sessions
    description: Raw-session upload, metadata, and download lifecycle.
  - name: Administration
    description: Organization-administrator policy and client operations.
  - name: User management
    description: >-
      Organization user lifecycle, session revocation, and invitation
      operations.
  - name: Identity provisioning
    description: SCIM 2.0 user and group provisioning for an external identity provider.
paths:
  /admin/users:
    get:
      tags:
        - User management
      summary: List users in the administrator's organization
      description: >-
        Includes active, suspended, and access-removed users so historical
        ownership remains visible.
      operationId: listAdminUsers
      parameters:
        - name: page
          in: query
          schema:
            type: integer
            minimum: 1
            default: 1
        - name: per_page
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 100
            default: 25
        - name: q
          in: query
          description: Case-insensitive email or subject substring
          schema:
            type: string
            maxLength: 200
        - name: role
          in: query
          schema:
            $ref: '#/components/schemas/GovernanceRole'
        - name: status
          in: query
          schema:
            $ref: '#/components/schemas/AdminUserStatus'
        - name: provisioning_source
          in: query
          schema:
            type: string
            enum:
              - local
              - scim
      responses:
        '200':
          description: Users
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AdminUserPage'
        '403':
          description: Administrator role required
      security:
        - oauthDevice: []
        - dashboardSession: []
components:
  schemas:
    GovernanceRole:
      type: string
      enum:
        - admin
        - member
    AdminUserStatus:
      type: string
      enum:
        - active
        - suspended
        - removed
    AdminUserPage:
      type: object
      required:
        - items
        - page
        - per_page
        - total
        - total_pages
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/AdminUser'
        page:
          type: integer
          minimum: 1
        per_page:
          type: integer
          minimum: 1
          maximum: 100
        total:
          type: integer
          minimum: 0
        total_pages:
          type: integer
          minimum: 0
    AdminUser:
      type: object
      required:
        - id
        - subject
        - email
        - role
        - active
        - status
        - protected
        - provisioning_source
        - managed
        - created_at
        - updated_at
      properties:
        id:
          type: string
          format: uuid
        subject:
          type: string
        email:
          type: string
          format: email
          example: developer@example.com
        role:
          $ref: '#/components/schemas/GovernanceRole'
        active:
          type: boolean
          description: Compatibility projection of status == active
        status:
          $ref: '#/components/schemas/AdminUserStatus'
        protected:
          type: boolean
          description: >-
            Deployment-managed identity that cannot be demoted, suspended, or
            deleted
        provisioning_source:
          type: string
          enum:
            - local
            - scim
        managed:
          type: boolean
          description: True when role and lifecycle are controlled through SCIM
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
  securitySchemes:
    oauthDevice:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >
        OAuth 2.0 access token obtained through RFC 8628 at
        /api/auth/device/code and /api/auth/oauth2/token. The API enforces
        governance:read, session:write, and client-status:write as appropriate.
    dashboardSession:
      type: apiKey
      in: cookie
      name: better-auth.session_token
      description: HTTP-only Better Auth dashboard session cookie.

````