---
title: "Retrieves all users for the organization with the specified short name (accessible to same-organization users or Secretariat)"
method: GET
path: "/org/{shortname}/users"
tags: ["Users"]
---

# Retrieves all users for the organization with the specified short name (accessible to same-organization users or Secretariat)

`GET /org/{shortname}/users`

<h2>Access Control</h2>  <p>Authenticated users can access this endpoint only for their own organization. Secretariat users can access any organization.</p>  <h2>Expected Behavior</h2>  <p><b>Regular, CNA & Admin Users:</b> Retrieves information about users in the same organization</p>  <p><b>Secretariat:</b> Retrieves all user information for any organization</p>

## Path parameters

- `shortname` string, required

## Query parameters

- `page` integer

## Headers

- `CVE-API-ORG` string, required
- `CVE-API-USER` string, required
- `CVE-API-KEY` string, required

## Response `200`

Returns all users for the organization, along with pagination fields if results span multiple pages of data

- ListUsersResponseJson — unresolved $ref

## Other responses

- `400` — Bad Request
- `401` — Not Authenticated
- `403` — Forbidden
- `404` — Not Found
- `500` — Internal Server Error

## Changes

- **2026-07-20** `a1102aabb125` — 1 warning
  - deleted the `query` request parameter `registry`
- **2025-12-05** `7225ce9cee29` — 2 info
  - for the `query` request parameter `registry`, the type/format was generalized from `boolean`/`` to `string`/``
  - removed `#/components/schemas/list-users-response.json, #/components/schemas/list-registry-users-response.json` from the response body `oneOf` list for the response status `200`
- **2025-11-04** `26ede34bbf48` — 1 breaking, 1 info
  - added `#/components/schemas/list-users-response.json, #/components/schemas/list-registry-users-response.json` to the response body `oneOf` list for the response status `200`
  - added the new optional `query` request parameter `registry`
- **2025-10-14** `2c44a137d9b0` — 1 warning, 1 info
  - deleted the `query` request parameter `registry`
  - removed `#/components/schemas/list-users-response.json, #/components/schemas/list-registry-users-response.json` from the response body `oneOf` list for the response status `200`
- **2025-09-19** `efebaec5edf0` — 2 breaking
  - for the `query` request parameter `registry`, the type/format was changed from `string`/`` to `boolean`/``
  - added `#/components/schemas/list-users-response.json, #/components/schemas/list-registry-users-response.json` to the response body `oneOf` list for the response status `200`

[Change history](https://skmtc.dev/cveproject/apis/cve-services-api/changes/org/:shortname/users/get.md)

---

[API](https://skmtc.dev/cveproject/apis/cve-services-api.md) · [All operations](https://skmtc.dev/cveproject/apis/cve-services-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cveproject/cve-services-api/revisions/a0323331d921/schema)