---
title: "Query Companies"
method: GET
path: "/companies"
tags: ["Company"]
---

# Query Companies

`GET /companies`

Used to query companies

## Query parameters

- `limit` integer
- `cursor` string

## Response `200`

Results of the query

- CompanyQueryResult
  - `companies` Company[] — All companies that matched the query
    - `id` string — The ID of the Company
    - `name` string — The Company name
    - `created_time` integer — Time at which the account was created
    - `created_by_id` string — The ID of the user who created this account
    - `last_updated_time` integer — Time at which the account was last updated
    - `last_updated_by_id` string — The ID of the user who last updated this account
    - `sso_connections` CompanySSOConnection[] — Array of sso connections
      - `connection_id` string — ID of SSO connection entity
    - `session_timeout` 'default' | 'hours_04' | 'hours_08' | 'hours_10' | 'hours_12' | 'hours_24' | 'hours_72' — The desired session timeout
    - `link_infrastructure_key` string — Key of the dedicated Link (mablnet) infrastructure cluster this company's tunnels are pinned to (e.g. `acme` -> `acme-wss.link.mabl.com`). Absent for the multi-tenant shared cluster (key `mabl`). Operator-managed via PUT/DELETE /companies/{id}/linkInfrastructureKey only — never via the generic company update.
    - `link_access_config` LinkAccessConfig — Consent flags governing who may reach a Link (mablnet) tunnel owned by this workspace or company. Deliberately separate from support_access_config: one of these flags has nothing to do with support, and reaching a customer's network is a distinct decision from seeing their workspace. Every flag is opt-in. An absent config, and an absent flag within a present config, both read as false; only new trial workspaces are created with them enabled. None of these flags affect api-key access to a tunnel — an `execution` key reaching a tunnel for a cloud test run is unaffected by all three.
      - `created_time` integer — created time, epoch millis
      - `created_by_id` string — created by user id
      - `last_updated_time` integer — last updated time, epoch millis
      - `last_updated_by_id` string — last update by user id
      - `enable_link_access_by_support` boolean — When true, a mabl support admin may reach the tunnel's published services, such as the SOCKS proxy and reachability probes. When false they may still reach the tunnel's control plane — draining a host, inspecting carriers — which is never gated, but no traffic-carrying service.
      - `enable_link_access_by_members` boolean — When true, a member of the owning workspace or company may reach the tunnel's published services with their own credentials. When false only api keys may, which stops interactive paths: desktop trainer sessions and local `mabl tests run` against a tunnel. Cloud execution authenticates with an api key and is unaffected either way.
      - `enable_personal_tunnels` boolean — When true, members of this workspace may start personal tunnels, and this workspace may route cloud test traffic to one. A user may start a personal tunnel if any workspace they belong to allows it, since no single workspace owns it; but only a workspace that allows them may send its runs through one.
  - `cursor` string — Cursor used for pagination

## Other responses

- `400` — Invalid or missing parameter
- `401` — User not authenticated
- `403` — User not authorized
- `default` — Unknown error

---

[API](https://skmtc.dev/mabl/apis/mabl-api.md) · [All operations](https://skmtc.dev/mabl/apis/mabl-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/mabl/mabl-api/revisions/97321e29d020/schema)