---
title: "GET /api/ee/mfa/admin/enrolled-users"
method: GET
path: "/api/ee/mfa/admin/enrolled-users"
tags: ["/api/ee/mfa"]
---

# GET /api/ee/mfa/admin/enrolled-users

`GET /api/ee/mfa/admin/enrolled-users`

## Request

- Base URL: `` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/ee/mfa/admin/enrolled-users`
- Auth: API key in header `X-API-Key`

Admin: users who have a confirmed second factor. Never feature-gated, for the same reason
  `/admin/remove` isn't — after a licence lapse an admin must still be able to find and unlock a
  locked-out user.

  Takes `limit`/`offset` for pagination, and `query` to search on first name, last name, and email.

## Query parameters

- `query` string, nullable

## Response `2XX`

Successful response

- object
  - `data` object[], required
    - `common_name` string, required
    - `email` string, required: value must be a non-blank string.
    - `enrolled_at` string, date-time, nullable, required: value must be a valid date/time/datetime
    - `first_name` string, nullable, required
    - `id` integer, required: value must be an integer greater than zero.
    - `is_active` boolean, required
    - `is_superuser` boolean, required
    - `last_name` string, nullable, required
    - `sso_source` string, nullable, required
  - `limit` integer, nullable, required
  - `offset` integer, nullable, required
  - `total` integer, required

## Other responses

- `4XX`: Client error response
- `5XX`: Server error response

## Changes

- **2026-11-04** `2e178f5a7934`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/metabase/apis/metabase-api/changes/api/ee/mfa/admin/enrolled-users/get.md)

---

[API](https://skmtc.dev/metabase/apis/metabase-api.md) - [All operations](https://skmtc.dev/metabase/apis/metabase-api/llms.txt) - [OpenAPI document](https://skmtc.dev/metabase/apis/metabase-api/revisions/2e178f5a7934?raw)