userrisk

Retrieve the list of users for your organization.

Required API key permissions: UserRisk (select when creating API key in Account Settings)

get/user_risk/users/list

Request

Query parameters

page_sizeinteger

The page size of results to return. If not supplied, default is 100.

page_tokenstring

The page_token from a previous request, use this to get the next page of results.

sort_by'id' | 'email' | 'name' | 'risk_rating'

The field to sort results by. Default is id.

sort_dir'asc' | 'desc'

The direction to sort results. Default is asc.

teamsstring[]

Limit the users to the ones belonging to the provided teams.

rolesstring[]

Limit the users to the ones with the provided roles.

app_namesstring[]

Limit the users to the ones using the provided apps.

has_browser_extensionboolean

Limit the users to the ones who have (true) or have not (false) logged in to the browser extension.

Response

The list of users in your organization

next_page_tokenstring

The token to be used to retrieve the next page of results. Will not be returned if there are no more results.

Example response

{
  "next_page_token": "e7cfc445-30a6-416c-8a12-0a988f042d08",
  "users": [
    {
      "app_stats": {
        "total_apps": 10
      },
      "breach_stats": {
        "active_breaches": 2,
        "total_breaches": 5
      },
      "browser_extension": {
        "first_login_at": "2026-09-01T08:00:00Z",
        "installed": true,
        "last_app_activity_at": "2026-10-20T09:30:00Z"
      },
      "email": "john.doe@example.com",
      "id": "e7cfc445-30a6-416c-8a12-0a988f042d08",
      "metadata": {
        "entra_user_id": "8fd39fd3-71b2-438e-9709-56fab71ab8d6"
      },
      "monitoring": {
        "monitored_since": "2025-03-04T05:06:07Z"
      },
      "name": "John Doe",
      "risk_rating": 900,
      "risk_rating_trend": 10,
      "role": "developer",
      "team": "product"
    }
  ]
}

Changes

    • info

      added the new optional query request parameter has_browser_extension

    • info

      added the new optional query request parameter sort_by

    • info

      added the new optional query request parameter sort_dir