accounts

List

Every account row the caller may read, newest-name-first by default: admin sees all tenants, tenant_admin and developer see their own tenant, a plain user sees only themselves — the same compiled row filter GET /accounts/summary uses, so a summary tile and the list it drills into always agree on which rows count. All query filters intersect (AND). since/until run on accounts.created_at and are parsed by the same window parser /accounts/summary uses, so the formats and error codes cannot drift between the two endpoints. Service accounts are excluded by default; kind=service|all surfaces them for tenant admins.

get/accounts

Request

  • Base URL: https://api.instruxi.dev/api/v1/enforcer
  • URL: https://api.instruxi.dev/api/v1/enforcer/accounts
  • Auth: one of:
    • API key in header Authorization
    • API key in header X-API-Key

Query parameters

qstring

free-text search

emailstring

exact email match

activeboolean

filter by active flag

email_verifiedboolean

true = verified emails only, false = unverified only; absent = no filter

profile_incompleteboolean

true = the PERSON (canonical name record) is missing a first or last name, false = complete profiles only; absent = no filter. Same predicate as the summary profile_complete tile and gRPC ListProfileIncomplete; service accounts are never incomplete

profile_completedboolean

admin-set provisioner flag (PATCH /accounts/:id/profile-completed): true = marked complete, false = awaiting review; absent = no filter. NOT the same as profile_incomplete, which derives from name data

verified_providerstring

accounts with a verified session from this provider (e.g. persona)

verification_status'verified' | 'pending' | 'failed' | 'none'

KYC rollup bucket, same precedence as /accounts/summary?group_by=verification_status

role'admin' | 'tenant_admin' | 'developer' | 'user'

role slug, same buckets as group_by=role

has_walletboolean

true = has at least one wallet, false = none

has_phoneboolean

true = a phone on the linked person, false = none

invitedboolean

true = invited by anyone, false = organic signup

invited_by_meboolean

only accounts I invited

invited_bystring uuid

only accounts invited by this account id (admin invitee tracking; row-level authz still applies)

group_idstring uuid

only members of this group; 404 group_not_found if the group is not visible to you

exclude_group_idstring uuid

drop members of this group; 404 group_not_found if the group is not visible to you

sincestring date-time

created at or after this instant (RFC3339) — same param as /accounts/summary

untilstring date-time

created before this instant (RFC3339) — same param as /accounts/summary

last_active_sincestring date-time

last active at or after this instant (RFC3339); never-active accounts never match

sort'name' | 'name_desc' | 'recent' | 'oldest' | 'active'

sort order

limitinteger

page size

offsetinteger

page offset

tenant_idstring uuid

list this tenant instead of your own (default: the caller's own tenant, platform admins included). Another tenant requires the cross_tenant grant — 403 otherwise

all_tenantsboolean

list EVERY tenant (platform-wide admin view). Requires the cross_tenant grant — 403 otherwise. Mutually exclusive with tenant_id (400 conflicting_tenant_scope)

kind'human' | 'service' | 'all'

account kind: human (default, excludes service accounts), service, or all. service|all require tenant admin (403 otherwise)

Response

OK

limitinteger
offsetinteger
successboolean
totalinteger

Example response

{
  "success": true
}

Changes

No recorded changes to this operation across all 1 revision of this API.