List internal users
/internal-usersLists the internal users in the token's organisation, newest first, and returns one page. filter[q] searches name and email, filter[status] takes active, pending, suspended, timeout, cooldown or deactivated, and include embeds groups, roles or invites. The old search, status, created_from and created_to parameters still work until 2027-06-30, with Deprecation and Sunset headers. Includes load per user; limit is at most 100. Sends nothing.
Query parameters
- Default:
Page size (1–100). Defaults to 25; values are clamped to the range.
25 Opaque pagination cursor taken from a prior response's
meta.next_cursor.Comma-separated top-level fields to return.
idis always returned.Comma-separated fields to sort by: created_at or updated_at. Prefix a field with
-for descending. Defaults to-created_at. The internal user id is the final tiebreak.Comma-separated related records to embed, from the operation's allowed list.
Free-text search on name and email.
- One of:
Only internal users in this state:
active,pending,suspended,timeout,cooldownordeactivated. Takes[in]and[not_in]with a comma-separated list.active,pending,suspended,timeout,cooldown,deactivated Only internal users with this email on any live contact. Takes
[in],[not_in]and[contains].Only internal users created in a range, written
filter[created_at][gte]=2026-10-01. Takes gt, gte, lt and lte.Only internal users changed in a range, written
filter[updated_at][gte]=2026-10-01. Takes gt, gte, lt and lte.Use
filter[q]. Still accepted until 2027-06-30.Use
filter[status]. Still accepted until 2027-06-30, with a comma-separated list of states.Use
filter[created_at][gte]. Still accepted until 2027-06-30.Use
filter[created_at][lte]. Still accepted until 2027-06-30.
Responses
{
"data": [
{
"id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
"first_name": "string",
"last_name": "string",
"title": "string",
"email": "string",
"status": "active",
"external_id": "string",
"sso_id": "string",
"invite": {
"id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
"status": "invited",
"expires_at": "2026-06-12T10:00:00+00:00"
},
"two_factor_enabled": true,
"last_login": "2026-06-12T10:00:00+00:00",
"created_at": "2026-06-12T10:00:00+00:00",
"updated_at": "2026-06-12T10:00:00+00:00",
"groups": [
{}
],
"invites": [
{}
],
"roles": [
{}
]
}
],
"meta": {
"limit": 1,
"next_cursor": "string",
"prev_cursor": "string"
}
}Authorization failed. error.code is one of org_disabled,
ip_blocked, missing_scope, scope_disabled, user_disabled.
The request can't be processed (HTTP 422): validation_failed with one ErrorDetail per
problem, or a code documented on the operation.
Examples
curl https://your-org-domain/kong/core/api/v2/internal-users\
-H "Authorization: Bearer $HELM_API_KEY"\
-H "Content-Type: application/json"