---
title: "List groups"
method: GET
path: "/zones/{zoneId}/groups"
tags: ["Groups"]
---

# List groups

`GET /zones/{zoneId}/groups`

## Request

- Base URL: `https://docs.keycard.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://docs.keycard.ai/zones/{zoneId}/groups`
- Auth: one of:
  - HTTP bearer
  - OAuth 2
    - Client credentials
    - Token URL: `/service-account-token`

Returns a paginated list of the groups in the specified zone. Use cursor pagination via `after`/`before`. Sort: comma-separated field list; prefix with `-` for descending (allowed: created_at, name, identifier). Pass `expand[]=member_count` to include each group's member count, `expand[]=roles` to include the identifiers of the roles assigned to each group, and `expand[]=total_count` to include the matching row count. Filter by exact identifier via `filter[identifier]` (repeatable, OR'd across values). Search via `query[]` (case-insensitive substring match, OR'd across repeated values); it matches the group's name and identifier. Pass `filter[external]=false` for only groups managed in Keycard or `filter[external]=true` for only groups synced from an external directory; omit it to list both. Filter externally synced groups by their directory issuer via `filter[external_issuer]` (exact match, repeatable, OR'd across values). Pass `filter[id]` (repeatable, max 100) to restrict results to a known set of groups — mutually exclusive with `after`/`before` (returns 400 if combined). When `filter[id]` is set, `limit` is ignored and the response contains every requested group that exists in the zone, in a single page. IDs not in the zone are silently omitted.

## Path parameters

- `zoneId` string, required

## Query parameters

- `after` string
- `before` string
- `limit` integer
- `expand[]` union
  - 'total_count' | 'member_count' | 'roles'
  - string[]
- `filter[id]` union
  - string: Restrict results to groups with this ID. Repeatable, max 100. Mutually exclusive with after/before.
  - string[]
- `filter[identifier]` union
  - string: Filter by exact group identifier
  - string[]
- `filter[external]` boolean
- `filter[external_issuer]` union
  - string: Filter by exact `external_issuer`: the issuer of the external directory the group was synced from. Groups managed in Keycard have no `external_issuer` and never match.
  - string[]
- `query[]` union
  - string: Search across name and identifier (substring match)
  - string[]
- `sort` string

## Response `200`

Default Response

- object
  - `items` IamGroup[], required
    - `id` string, required: Unique identifier of the group
    - `zone_id` string, required: Zone this group belongs to
    - `organization_id` string, required: Organization this group belongs to
    - `identifier` string, required: User-specified identifier, unique within the zone. Automatically assigned for groups from an external directory.
    - `name` string, required: Human-readable group name
    - `external` boolean, required: Whether the group is synced from an external directory over SCIM. When true the group is directory-owned and its membership is read-only while the zone has `external_sync_enabled` set.
    - `external_issuer` string, nullable, required: Issuer of the external directory the group was synced from. `null` for groups managed in Keycard. Read-only: set by external sync, never by the caller.
    - `member_count` integer: Number of users in the group. Included only when requested via `expand[]=member_count` (group get or list).
    - `roles` string[]: Identifiers of the roles assigned to the group; members inherit them. Deduped across scopes. Included only when requested via `expand[]=roles` (group get or list).
    - `created_at` string, date-time, required: Entity creation timestamp
    - `updated_at` string, date-time, required: Entity update timestamp
  - `pagination` IamPagination, required: Cursor-based pagination metadata
    - `after_cursor` string, required: An opaque cursor used for paginating through a list of results
    - `before_cursor` string, required: An opaque cursor used for paginating through a list of results
    - `total_count` integer: Total number of items matching the query. Only included when expand[]=total_count is requested.

## Other responses

- `default`: Error response

## Changes

- **2026-10-16** `0cfaff865771`: 3 info
  - added the new optional `query` request parameter `filter[external]`
  - added the new optional `query` request parameter `filter[external_issuer]`
  - added the required property `items/items/external_issuer` to the response with the `200` status
- **2026-08-26** `d65d51379d93`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/changes/zones/:zoneId/groups/get.md)

---

[API](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api.md) - [All operations](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/llms.txt) - [OpenAPI document](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/revisions/0dee67e0a73a?raw)