---
title: "List users"
method: GET
path: "/v1/users"
tags: ["User"]
---

# List users

`GET /v1/users`

Returns the list of users visible to the caller. For a normal user this is
scoped to **their own account only**; Cardda staff see all users. Each item
is augmented with computed methods (`milestone_ids`, `n_companies`,
`company_role`, capability flags, `plh_profile_complete`,
`missing_plh_profile_fields`, `needs_password_setup`).

This endpoint is **not company-scoped** — visibility comes from the user
policy, not the `company-id` header.

## Query parameters

- `_start` integer
- `_end` integer
- `_order` 'asc' | 'desc'
- `_field` string

## Headers

- `company-id` string, uuid, required

## Response `200`

Paginated list of users.

- User[]
  - `id` string, required — Firebase UID.
  - `first_name` string, nullable
  - `last_name` string, nullable
  - `email` string, nullable
  - `phone` integer, nullable
  - `identifier` string, nullable — Tax id / national id of the user.
  - `country` string, nullable
  - `nationality` string, nullable
  - `address` string, nullable
  - `occupation` string, nullable
  - `gender` integer, nullable
  - `birthdate` string, date-time, nullable
  - `is_pep` boolean — Whether the user is a politically exposed person.
  - `legal_address` object, nullable
  - `user_type` string, nullable
  - `status` string
  - `terms_accepted` boolean
  - `legal_representative` boolean, nullable
  - `has_powers_to_act` boolean, nullable
  - `whatsapp_verified` boolean
  - `milestone_ids` string[] — Computed list of milestone ids reached by the user.
  - `n_companies` integer — Number of companies the user belongs to (computed).
  - `company_role` string, nullable — The user's role in the current company context (computed).
  - `plh_profile_complete` boolean — Whether the user's PLH profile is complete (computed; serialized as `plh_profile_complete?`).
  - `missing_plh_profile_fields` string[]
  - `needs_password_setup` boolean — Whether the user still needs to set a password (computed; serialized as `needs_password_setup?`).
  - `created_at` string, date-time
  - `updated_at` string, date-time

## Other responses

- `401` — Unauthorized

---

[API](https://skmtc.dev/cardda/apis/banking-api.md) · [All operations](https://skmtc.dev/cardda/apis/banking-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cardda/banking-api/revisions/ff1aeb3fda8b/schema)