---
title: "GET /api/ee/mfa/admin/unenrolled-users"
method: GET
path: "/api/ee/mfa/admin/unenrolled-users"
tags: ["/api/ee/mfa"]
---

# GET /api/ee/mfa/admin/unenrolled-users

`GET /api/ee/mfa/admin/unenrolled-users`

## Request

- Base URL: `` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/ee/mfa/admin/unenrolled-users`
- Auth: API key in header `X-API-Key`

Admin: active users who have not set up a second factor. Matches `unenrolled_count` from
  `/admin/overview`, so people who sign in through SSO are included even though the login gate never
  challenges them — their identity provider owns MFA. Never feature-gated, as above.

  Takes `limit`/`offset` for pagination, and `query` to search on first name, last name, and email.

## Query parameters

- `query` string, nullable

## Response `2XX`

Successful response

- object
  - `data` object[], required
    - `common_name` string, required
    - `email` string, required: value must be a non-blank string.
    - `first_name` string, nullable, required
    - `id` integer, required: value must be an integer greater than zero.
    - `is_active` boolean, required
    - `is_superuser` boolean, required
    - `last_name` string, nullable, required
    - `sso_source` string, nullable, required
  - `limit` integer, nullable, required
  - `offset` integer, nullable, required
  - `total` integer, required

## Other responses

- `4XX`: Client error response
- `5XX`: Server error response

## Changes

- **2026-11-04** `2e178f5a7934`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/metabase/apis/metabase-api/changes/api/ee/mfa/admin/unenrolled-users/get.md)

---

[API](https://skmtc.dev/metabase/apis/metabase-api.md) - [All operations](https://skmtc.dev/metabase/apis/metabase-api/llms.txt) - [OpenAPI document](https://skmtc.dev/metabase/apis/metabase-api/revisions/2e178f5a7934?raw)