---
title: "GET /staff/users"
method: GET
path: "/staff/users"
tags: ["Staff"]
---

# GET /staff/users

`GET /staff/users`

## Request

- Base URL: `https://api.laver.app` (the document declares no server; this is the origin it was published from)
- URL: `https://api.laver.app/staff/users`
- Auth: HTTP bearer

## Query parameters

- `query` string
- `include_deleted` boolean
- `verification` union
  - 'verified'
  - 'unverified'
- `locked_out` boolean
- `activity` union
  - 'active'
  - 'dormant'
- `active` union
  - 'dau'
  - 'wau'
  - 'mau'
- `cursor` string
- `limit` integer

## Response `200`

Success. The properties described here are the ones the response schema enforces; the body also carries fields it does not yet declare.

- object
  - `users` object[], nullable
    - `uuid` string, nullable
    - `first_name` string, nullable
    - `last_name` string, nullable
    - `email` string, nullable
    - `profile_image_url` string, nullable
    - `verified` boolean, nullable
    - `totp_enabled` boolean, nullable
    - `phone_number_verified` boolean, nullable
    - `attempts` integer, nullable
    - `timeout_until` string, nullable
    - `max_timeout` boolean, nullable
    - `is_locked_out` boolean, nullable
    - `last_attempted_at` string, nullable
    - `created_at` string, nullable
    - `updated_at` string, nullable
    - `deleted_at` string, nullable
    - `purged_at` string, nullable
    - `terms_accepted_at` string, nullable
    - `terms_version` string, nullable
    - `staff_role` string, nullable
    - `staff_access` object, nullable
      - `role` string, nullable
      - `is_active` boolean, nullable
      - `expires_at` string, nullable
      - `is_live` boolean, nullable
    - `membership_count` integer, nullable
    - `active_membership_count` integer, nullable
    - `owned_workspace_count` integer, nullable
    - `active_api_key_count` integer, nullable
    - `last_activity_at` string, nullable
    - `activity_bucket` string, nullable
    - `workspaces` object[], nullable
      - `workspace_uuid` string, nullable
      - `name` string, nullable
      - `slug` string, nullable
      - `role` string, nullable
      - `is_active` boolean, nullable
      - `member_since` string, nullable
      - `plan` string, nullable
      - `billing_status` string, nullable
      - `seats` integer, nullable
      - `is_comped` boolean, nullable
      - `archived_at` string, nullable
      - `suspended_at` string, nullable
      - `closure_scheduled_at` string, nullable

## Other responses

- `400`: The request failed schema validation, or the handler rejected its contents. Undeclared properties are rejected on every body, path and query schema, so an unexpected field is a 400 rather than a silently ignored one.
- `401`: No credential, or one that is expired, revoked or not accepted by this endpoint.
- `403`: Authenticated, but not allowed: a `viewer` attempting a write, a `commenter` attempting any write other than a comment on a ticket it can see, a `guest` writing anywhere or a `guest_editor` writing outside the boards it was given, a non-admin on an admin route, a non-owner on billing, or a non-staff user on staff tooling.
- `429`: The rate limit was exceeded. The budget is keyed on the authenticated session user or API key, falling back to the caller IP.

---

[API](https://skmtc.dev/laver/apis/laver-api.md) · [All operations](https://skmtc.dev/laver/apis/laver-api/llms.txt) · [OpenAPI document](https://skmtc.dev/laver/apis/laver-api/revisions/91e3db25a19c?raw)