AD Base Entities3

AD Users11

AIA CAs3

Alerts17

Analysis3

API Info2

API Tokens3

Asset Isolation33

Asset Scores1

Attack Paths11

Audit1

Auth14

Azure Entities1

BloodHound Users12

Cert Templates3

Client Ingest1

Clients24

Collection Uploads6

Collectors6

Computers16

Config4

Containers2

Custom Node Management5

Cypher12

Data Quality6

Database1

Datapipe4

Domains17

Enterprise CAs4

EULA1

Events (Schedules)5

GPOs6

Graph7

Groups10

Jobs9

Meta Entities1

NT Auth Stores3

OpenGraph (Experimental)8

OUs5

Permissions2

Risk Posture2

Roles2

Root CAs3

Search2

Tasks9

BloodHound Users

Community

Enterprise

List Users

Gets all BloodHound user details.

get/api/v2/bloodhound-users

Query parameters

sort_bystring

Sort by column. Can be used multiple times; prepend a hyphen for descending order. See parameter description for details about which columns are sortable.

Sortable columns are first_name, last_name, email_address, principal_name, last_login, created_at, updated_at, deleted_at.

first_namestring

Filter results by column string value. Valid filter predicates are eq, ~eq, neq.

last_namestring

Filter results by column string value. Valid filter predicates are eq, ~eq, neq.

email_addressstring

Filter results by column string value. Valid filter predicates are eq, ~eq, neq.

principal_namestring

Filter results by column string value. Valid filter predicates are eq, ~eq, neq.

idstring

Filter results by column string-formatted uuid value. Valid filter predicates are eq, neq.

last_loginstring

Filter results by column timestamp value formatted as an RFC-3339 string. Valid filter predicates are eq, neq, gt, gte, lt, lte.

created_atstring

Filter results by column timestamp value formatted as an RFC-3339 string. Valid filter predicates are eq, neq, gt, gte, lt, lte.

Filter results by created_at value. See filter schema details for valid predicates.

updated_atstring

Filter results by column timestamp value formatted as an RFC-3339 string. Valid filter predicates are eq, neq, gt, gte, lt, lte.

Filter results by updated_at value. See filter schema details for valid predicates.

deleted_atstring

Filter results by column timestamp value formatted as an RFC-3339 string. Valid filter predicates are eq, neq, gt, gte, lt, lte.

Filter results by deleted_at value. See filter schema details for valid predicates.

Response

Changes

Changed in 6 of the 66 revisions of this API.25227

Apr 3, 2026f87a90d5a2d011See the full diff
- ▲
  added the pattern ^((eq|neq):)?[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$ to the query request parameter id
  request-parameter-pattern-added
- ○
  for the query request parameter id, the type/format was generalized from string/uuid to string/
  request-parameter-type-generalized
Apr 1, 202640bf219eced684See the full diff
- ▲
  added the pattern ^((eq|neq|gt|gte|lt|lte):)?[0-9]{4}-[0-9]{2}-[0-9]{2}[Tt][0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{1,9})?([Zz]|-[0-9]{2}:[0-9]{2})$ to the query request parameter created_at
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|neq|gt|gte|lt|lte):)?[0-9]{4}-[0-9]{2}-[0-9]{2}[Tt][0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{1,9})?([Zz]|-[0-9]{2}:[0-9]{2})$ to the query request parameter deleted_at
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|neq|gt|gte|lt|lte):)?[0-9]{4}-[0-9]{2}-[0-9]{2}[Tt][0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{1,9})?([Zz]|-[0-9]{2}:[0-9]{2})$ to the query request parameter last_login
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|neq|gt|gte|lt|lte):)?[0-9]{4}-[0-9]{2}-[0-9]{2}[Tt][0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{1,9})?([Zz]|-[0-9]{2}:[0-9]{2})$ to the query request parameter updated_at
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|~eq|neq):)?[^:]+$ to the query request parameter email_address
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|~eq|neq):)?[^:]+$ to the query request parameter first_name
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|~eq|neq):)?[^:]+$ to the query request parameter last_name
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|~eq|neq):)?[^:]+$ to the query request parameter principal_name
  request-parameter-pattern-added
- ○
  for the query request parameter created_at, the type/format was generalized from string/date-time to string/
  request-parameter-type-generalized
- ○
  for the query request parameter deleted_at, the type/format was generalized from string/date-time to string/
  request-parameter-type-generalized
- ○
  for the query request parameter last_login, the type/format was generalized from string/date-time to string/
  request-parameter-type-generalized
- ○
  for the query request parameter updated_at, the type/format was generalized from string/date-time to string/
  request-parameter-type-generalized
Apr 1, 20266aaeba6ecdc548See the full diff
- ▲
  for the query request parameter created_at, the type/format was changed from string/ to string/date-time
  request-parameter-type-changed
- ▲
  for the query request parameter deleted_at, the type/format was changed from string/ to string/date-time
  request-parameter-type-changed
- ▲
  for the query request parameter last_login, the type/format was changed from string/ to string/date-time
  request-parameter-type-changed
- ▲
  for the query request parameter updated_at, the type/format was changed from string/ to string/date-time
  request-parameter-type-changed
- ○
  removed the pattern ^((eq|neq|gt|gte|lt|lte):)?[0-9]{4}-[0-9]{2}-[0-9]{2}[Tt][0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{1,9})?([Zz]|-[0-9]{2}:[0-9]{2})$ from the query request parameter created_at
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|neq|gt|gte|lt|lte):)?[0-9]{4}-[0-9]{2}-[0-9]{2}[Tt][0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{1,9})?([Zz]|-[0-9]{2}:[0-9]{2})$ from the query request parameter deleted_at
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|neq|gt|gte|lt|lte):)?[0-9]{4}-[0-9]{2}-[0-9]{2}[Tt][0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{1,9})?([Zz]|-[0-9]{2}:[0-9]{2})$ from the query request parameter last_login
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|neq|gt|gte|lt|lte):)?[0-9]{4}-[0-9]{2}-[0-9]{2}[Tt][0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{1,9})?([Zz]|-[0-9]{2}:[0-9]{2})$ from the query request parameter updated_at
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|~eq|neq):)?[^:]+$ from the query request parameter email_address
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|~eq|neq):)?[^:]+$ from the query request parameter first_name
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|~eq|neq):)?[^:]+$ from the query request parameter last_name
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|~eq|neq):)?[^:]+$ from the query request parameter principal_name
  request-parameter-pattern-removed
Apr 1, 2026674e0a229e8a84See the full diff
- ▲
  added the pattern ^((eq|neq|gt|gte|lt|lte):)?[0-9]{4}-[0-9]{2}-[0-9]{2}[Tt][0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{1,9})?([Zz]|-[0-9]{2}:[0-9]{2})$ to the query request parameter created_at
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|neq|gt|gte|lt|lte):)?[0-9]{4}-[0-9]{2}-[0-9]{2}[Tt][0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{1,9})?([Zz]|-[0-9]{2}:[0-9]{2})$ to the query request parameter deleted_at
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|neq|gt|gte|lt|lte):)?[0-9]{4}-[0-9]{2}-[0-9]{2}[Tt][0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{1,9})?([Zz]|-[0-9]{2}:[0-9]{2})$ to the query request parameter last_login
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|neq|gt|gte|lt|lte):)?[0-9]{4}-[0-9]{2}-[0-9]{2}[Tt][0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{1,9})?([Zz]|-[0-9]{2}:[0-9]{2})$ to the query request parameter updated_at
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|~eq|neq):)?[^:]+$ to the query request parameter email_address
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|~eq|neq):)?[^:]+$ to the query request parameter first_name
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|~eq|neq):)?[^:]+$ to the query request parameter last_name
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|~eq|neq):)?[^:]+$ to the query request parameter principal_name
  request-parameter-pattern-added
- ○
  for the query request parameter created_at, the type/format was generalized from string/date-time to string/
  request-parameter-type-generalized
- ○
  for the query request parameter deleted_at, the type/format was generalized from string/date-time to string/
  request-parameter-type-generalized
- ○
  for the query request parameter last_login, the type/format was generalized from string/date-time to string/
  request-parameter-type-generalized
- ○
  for the query request parameter updated_at, the type/format was generalized from string/date-time to string/
  request-parameter-type-generalized
Feb 3, 20265ce93c0f58aa2See the full diff
- ●
  removed the optional property data/users/items/allOf[subschema #3]/all_environments from the response with the 200 status
  response-optional-property-removed
- ●
  removed the optional property data/users/items/allOf[subschema #3]/environment_targeted_access_control from the response with the 200 status
  response-optional-property-removed
This revision also has 1 change that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog
Jan 12, 2026a426ff0abf8f410See the full diff
- ▲
  for the query request parameter created_at, the type/format was changed from string/ to string/date-time
  request-parameter-type-changed
- ▲
  for the query request parameter deleted_at, the type/format was changed from string/ to string/date-time
  request-parameter-type-changed
- ▲
  for the query request parameter last_login, the type/format was changed from string/ to string/date-time
  request-parameter-type-changed
- ▲
  for the query request parameter updated_at, the type/format was changed from string/ to string/date-time
  request-parameter-type-changed
- ○
  removed the pattern ^((eq|neq|gt|gte|lt|lte):)?[0-9]{4}-[0-9]{2}-[0-9]{2}[Tt][0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{1,9})?([Zz]|-[0-9]{2}:[0-9]{2})$ from the query request parameter created_at
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|neq|gt|gte|lt|lte):)?[0-9]{4}-[0-9]{2}-[0-9]{2}[Tt][0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{1,9})?([Zz]|-[0-9]{2}:[0-9]{2})$ from the query request parameter deleted_at
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|neq|gt|gte|lt|lte):)?[0-9]{4}-[0-9]{2}-[0-9]{2}[Tt][0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{1,9})?([Zz]|-[0-9]{2}:[0-9]{2})$ from the query request parameter last_login
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|neq|gt|gte|lt|lte):)?[0-9]{4}-[0-9]{2}-[0-9]{2}[Tt][0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{1,9})?([Zz]|-[0-9]{2}:[0-9]{2})$ from the query request parameter updated_at
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|~eq|neq):)?[^:]+$ from the query request parameter email_address
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|~eq|neq):)?[^:]+$ from the query request parameter first_name
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|~eq|neq):)?[^:]+$ from the query request parameter last_name
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|~eq|neq):)?[^:]+$ from the query request parameter principal_name
  request-parameter-pattern-removed
- ○
  added the optional property data/users/items/allOf[subschema #3]/all_environments to the response with the 200 status
  response-optional-property-added
- ○
  added the optional property data/users/items/allOf[subschema #3]/environment_targeted_access_control to the response with the 200 status
  response-optional-property-added
This revision also has 3 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog

Full history