---
title: "List all system administrators"
method: GET
path: "/system/admin/list"
tags: ["System Admin"]
---

# List all system administrators

`GET /system/admin/list`

Retrieve a paginated list of users with system administrator
privileges (SystemAdmin only). Supports `offset` (default 0)
and `limit` (default 50, max 200) query parameters. Walks the
partial-friendly idx_users_is_system_admin index.

## Query parameters

- `offset` integer
- `limit` integer

## Response `200`

System admins retrieved successfully

- InternalHandlerListSystemAdminsResponse
  - `admins` GithubComTencentWeKnoraInternalTypesUserInfo[]
    - `avatar` string
    - `can_access_all_tenants` boolean
    - `created_at` string
    - `email` string
    - `id` string
    - `is_active` boolean
    - `is_system_admin` boolean
    - `preferences` GithubComTencentWeKnoraInternalTypesUserPreferences
      - `last_active_tenant_id` integer — LastActiveTenantID remembers the last workspace the user actively switched into, so a fresh login (new device, cleared browser, new refresh token) lands them back in that workspace instead of always bouncing to their home workspace. Written by the SPA's preferences PUT and by service-level SwitchTenant (including when switching home, which stores the home ID). Login / RefreshToken validate that the workspace still exists and the user still has an active membership (or CanAccessAllTenants) before honouring this preference; an invalid pointer is best-effort cleared and the user falls back to home. Refresh JWT claims have no tenant_id, so RefreshToken re-resolves from this field. nil = no preference (use user.TenantID, i.e. home) *0 = "clear preference" sentinel for the partial-update endpoint (UpdateUserPreferences turns this into nil). Otherwise treat a stored *0 the same as nil. *N = preferred workspace id.
      - `oidc_only_login` boolean — OidcOnlyLogin is set server-side when an account is auto-provisioned via OIDC with a random password the user never received. The profile UI hides self-service password rotation until the user sets a known password via ChangePassword (which clears this flag).
    - `tenant_id` integer
    - `updated_at` string
    - `username` string
  - `total` integer

## Other responses

- `403` — Forbidden: not a system admin

## Changes

- **2026-06-05** `e7c0c953963b` — 1 info
  - endpoint added
- **2025-12-16** `edf61e68559d` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/tencentblueking/apis/weknora-api/changes/system/admin/list/get.md)

---

[API](https://skmtc.dev/tencentblueking/apis/weknora-api.md) · [All operations](https://skmtc.dev/tencentblueking/apis/weknora-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/tencentblueking/weknora-api/revisions/8bcae298fb2f/schema)