---
title: "List app-user identities for the owner"
method: POST
path: "/internal/apps/{appId}/data/identity-candidates"
tags: ["Data"]
---

# List app-user identities for the owner

`POST /internal/apps/{appId}/data/identity-candidates`

## Request

- Base URL: `https://api.percher.run`
- URL: `https://api.percher.run/internal/apps/{appId}/data/identity-candidates`
- Auth: API key in header `X-Internal-Secret`

Internal same-origin dashboard hop. Owner and app activation gate required. Only non-system auth collections and visible text, number or select label fields; email, password, tokenKey and passwordConfirm are refused case-insensitively. Owner match requires both a verified Percher email and a verified app user. No OAuth or API-token authorization.

## Path parameters

- `appId` string, required

## Request body

- object
  - `userId` string, required
  - `collectionId` string
  - `displayField` string
  - `q` string
  - `page` integer

## Response `200`

collections with eligible fields, candidates (at most 20; labels at most 80 characters), verified ownerMatch or null, rulesLockAll over data collections only

## Other responses

- `400`: Invalid picker settings
- `401`: Invalid internal credential
- `403`: DATA_TOOLS_NOT_ENABLED or forbidden field/collection
- `404`: App not owned
- `503`: PB_NOT_RUNNING

---

[API](https://skmtc.dev/percher/apis/percher-api.md) · [All operations](https://skmtc.dev/percher/apis/percher-api/llms.txt) · [OpenAPI document](https://skmtc.dev/percher/apis/percher-api/revisions/d9e7089c21e5?raw)