---
title: "List users"
method: GET
path: "/user_risk/users/list"
tags: ["userrisk"]
---

# List users

`GET /user_risk/users/list`

## Request

- Base URL: `https://cyber-risk.upguard.com/api/public`
- URL: `https://cyber-risk.upguard.com/api/public/user_risk/users/list`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/docs/user_risk/users/list/get.ts> (a function with typed inputs; its response is checked against the schema)

Retrieve the list of users for your organization.

Required API key permissions: `UserRisk` (select when creating API key in Account Settings)

## Query parameters

- `page_size` integer
- `page_token` string
- `sort_by` 'id' | 'email' | 'name' | 'risk_rating'
- `sort_dir` 'asc' | 'desc'
- `teams` string[]
- `roles` string[]
- `app_names` string[]
- `has_browser_extension` boolean

## Response `200`

The list of users in your organization

- UserRiskUsersListResponse
  - `next_page_token` string: The token to be used to retrieve the next page of results. Will not be returned if there are no more results.
  - `users` User[], required: List of users.
    - `app_stats` UserAppStats, required
      - `total_apps` integer, required: The total number of applications used by the user.
    - `breach_stats` UserIdentityBreachesStats, required
      - `active_breaches` integer, required: The number of active identity breaches this user was involved in that have not been remediated yet.
      - `total_breaches` integer: The total number of identity breaches this user was involved in. required: 10
    - `browser_extension` UserBrowserExtension, required
      - `first_login_at` string, date-time: When the user first logged in to the browser extension, in UTC. Null if they never did.
      - `installed` boolean, required: Whether the user logged in to the browser extension at least once. An uninstall is not recorded.
      - `last_app_activity_at` string, date-time: The latest app use seen by the browser extension, in UTC. Null when no app use falls within the organization's visited app retention period (30 days by default).
    - `email` string, required: The email address of the user.
    - `id` string, required: The ID of the user.
    - `metadata` UserMetadata, required
      - `entra_user_id` string: The Microsoft Entra ID (formerly Azure AD) of the user if any.
      - `microsoft_guest` boolean: Whether the user is a guest in the Microsoft directory, if known.
    - `monitoring` UserMonitoring, required
      - `monitored_since` string, date-time: When the user's monitoring record was created, in UTC. Users monitored long ago can carry a backfill time.
    - `name` string, required: The full name of the user.
    - `risk_rating` integer: Risk rating for the user.
    - `risk_rating_trend` integer, required: The user risk rating trend for the last 30 days.
    - `role` string: The role assigned to the user.
    - `team` string: The team the user belongs to.

## Other responses

- `403`: Your API key does not have permission to perform this action.
- `422`: An invalid parameter was supplied or a mandatory parameter was missing
- `429`: Too many requests have been made to this endpoint.
- `500`: An internal system error occurred

## Changes

- **2026-11-07** `d044bf6dc61e`: 3 info
  - added the new optional `query` request parameter `has_browser_extension`
  - added the new optional `query` request parameter `sort_by`
  - added the new optional `query` request parameter `sort_dir`

[Operation history](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/changes/user_risk/users/list/get.md)

---

[API](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api.md) - [All operations](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/llms.txt) - [OpenAPI document](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/revisions/d044bf6dc61e?raw)