List users

Returns a paginated list of users in the specified zone.

Use cursor pagination via after/before. Sort: comma-separated field list; prefix with - for descending. Use expand[]=total_count to include the matching row count, expand[]=session_count to include per-user session counts, expand[]=grant_count to include per-user delegated-grant counts, expand[]=role-assignments to include each user's structured role grants (direct grants only by default, each tagged with source; use role_source=all to also include group-inherited), expand[]=groups to include each user's group memberships, expand[]=credentials to include each user's authentication credentials (each with its provider_id), and expand[]=credentials.provider to additionally inline the full identity provider on each federation credential. Filter by exact email via filter[email] and by exact identifier via filter[identifier]; restrict to members of a group via filter[groups] (repeatable, OR'd across values); restrict to users directly granted a role via filter[role] (role identifier, repeatable up to 100, OR'd across values; group-inherited grants do not match); pass filter[external]=false for only users managed in Keycard or filter[external]=true for only users provisioned by an external directory (omit to list both); match exactly on the user's subject and issuer via filter[subject] and filter[issuer] (each repeatable and OR'd across values; AND'd with each other); search via query[email] / query[subject] / query[] (substring match, OR'd across repeated values). query[] matches against email and the user's subject. Pass filter[id] (repeatable, max 100) to restrict results to a known set of users — mutually exclusive with after/before (returns 400 if combined). When filter[id] is set, limit is ignored and the response contains every requested user that exists in the zone, in a single page. IDs not in the zone are silently omitted.