---
title: "List App User Candidates"
method: GET
path: "/api/apps/{name}/users/candidates"
tags: ["apps"]
---

# List App User Candidates

`GET /api/apps/{name}/users/candidates`

## Request

- Base URL: `https://softkiln.com` (the document declares no server; this is the origin it was published from)
- URL: `https://softkiln.com/api/apps/{name}/users/candidates`
- Auth: none declared

Who this app's admin may still grant access to: the app's ORG members.

Exactly the set `add_app_user` below accepts, minus whoever already holds a
grant — so every name the picker offers is one the POST will take.

The UI used to build this list from `GET /users`, which is platform-admin
only and returns every user on the platform. For an ordinary org owner that
call 403s and the dropdown rendered empty with no error, so nobody outside
platform staff could add a user to an app at all; for platform staff it
listed every customer's address on the platform and most of them would have
been refused on submit. Neither half was right.

## Path parameters

- `name` string, required

## Response `200`

Successful Response

- AppUserCandidatesOut: The picker's whole state, so the UI never has to guess at the org. `AppOut` carries no organization at all, which is why the dropdown was filled from the platform-wide `/users` in the first place. Everything the section needs to decide what to offer comes back here instead.
  - `candidates` AppUserCandidateOut[], required
    - `id` string, required
    - `email` string, required
    - `pending` boolean
  - `can_invite` boolean, required
  - `org_plan` string, required
  - `org_slug` string, nullable

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/softkiln/apis/app-manager-api.md) · [All operations](https://skmtc.dev/softkiln/apis/app-manager-api/llms.txt) · [OpenAPI document](https://skmtc.dev/softkiln/apis/app-manager-api/revisions/de2b674a7f21?raw)