> ## Documentation Index > Fetch the complete documentation index at: https://docs.flowpayroll.ai/llms.txt > Use this file to discover all available pages before exploring further. # List the people in your account > Everyone who can sign in to your account, paginated in `principalId` order, followed by your **guests** — people from other businesses you invited into specific organisations. `accessType` on each row says which — `Customer` or `Guest` — and the `accessType` query parameter filters to one kind. One page holds one kind, so follow the token to exhaustion to see both. A guest row shows only the access you granted. `organisationId` narrows the list to the people who can reach one organisation, whether by a direct grant or by account-wide access, and answers 404 if that organisation is not yours. `search` matches a name or email address **within the page returned**, so a page can hold fewer rows than `pageSize` while a `paginationToken` is still present — keep following the token. An account may hold 500 people; guests use none of those places. Read the list to exhaustion to count them before offering to invite another. A few accounts hold more, from before the limit existed, and keep everyone they have. ## OpenAPI ````yaml /api-reference/specs/administration.json get /users openapi: 3.0.1 info: title: Administration API description: >- Manage your Flow Payroll account: the organisations it owns, the people who can sign in to it, the API tokens it holds, its brand, and a feed of recent administration activity. Every resource is scoped to the account your credentials belong to, so no request ever names a customer and the `X-Org-Id` header is not used. version: v1 servers: - url: https://api.sandbox.flowpayroll.ai/v1/administration security: - X-Auth-Token: [] tags: - name: Customer description: >- Your account: the customer every other resource on this API belongs to. Read it and rename it. - name: Organisations description: >- The organisations your account owns: list them with headcounts and your access to each, get one in full, and add one or several at a time. - name: Users description: >- The people who can sign in to your account: list, invite (one or many), resend invitations, and manage each person's direct grants and account-wide access. - name: API tokens description: >- The client credentials your integrations authenticate with: create (the secret is shown once), rename, rotate, revoke, and manage which organisations each token reaches. - name: Activity description: Recent administration actions in your account, newest first. paths: /users: get: tags: - Users summary: List the people in your account description: >- Everyone who can sign in to your account, paginated in `principalId` order, followed by your **guests** — people from other businesses you invited into specific organisations. `accessType` on each row says which — `Customer` or `Guest` — and the `accessType` query parameter filters to one kind. One page holds one kind, so follow the token to exhaustion to see both. A guest row shows only the access you granted. `organisationId` narrows the list to the people who can reach one organisation, whether by a direct grant or by account-wide access, and answers 404 if that organisation is not yours. `search` matches a name or email address **within the page returned**, so a page can hold fewer rows than `pageSize` while a `paginationToken` is still present — keep following the token. An account may hold 500 people; guests use none of those places. Read the list to exhaustion to count them before offering to invite another. A few accounts hold more, from before the limit existed, and keep everyone they have. operationId: GetUsers parameters: - name: search in: query schema: type: string - name: organisationId in: query schema: type: string - name: pageSize in: query schema: type: string - name: paginationToken in: query schema: type: string - name: accessType in: query description: >- Customer for the account's own, Guest for guest access, absent for both. schema: enum: - Customer - Guest type: string responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/UserListResponseResponseBody' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' components: schemas: UserListResponseResponseBody: type: object properties: message: $ref: '#/components/schemas/MessageWithTokenResponse' content: $ref: '#/components/schemas/UserListResponseContentResponse' validationIssues: type: array items: $ref: '#/components/schemas/ValidationIssue' nullable: true additionalProperties: false ObjectResponseBody: type: object properties: message: $ref: '#/components/schemas/MessageWithTokenResponse' content: $ref: '#/components/schemas/ObjectContentResponse' validationIssues: type: array items: $ref: '#/components/schemas/ValidationIssue' nullable: true additionalProperties: false MessageWithTokenResponse: type: object properties: text: type: string token: type: string tokenArguments: type: array items: $ref: '#/components/schemas/ValidationIssueArgument' nullable: true additionalProperties: false UserListResponseContentResponse: type: object properties: data: $ref: '#/components/schemas/UserListResponse' metadata: $ref: '#/components/schemas/ContentMetadataResponse' additionalProperties: false ValidationIssue: type: object properties: field: type: string reason: type: string reasonToken: type: string reasonTokenArguments: type: array items: $ref: '#/components/schemas/ValidationIssueArgument' nullable: true additionalProperties: false ObjectContentResponse: type: object properties: data: nullable: true metadata: $ref: '#/components/schemas/ContentMetadataResponse' additionalProperties: false ValidationIssueArgument: type: object properties: name: type: string value: nullable: true additionalProperties: false UserListResponse: type: object properties: users: type: array items: $ref: '#/components/schemas/UserSummaryResponse' description: The page. paginationToken: type: string description: >- Null on the last page. Follow it until it is absent. Also published at `content.metadata.paginationToken`, which is the location to prefer. nullable: true additionalProperties: false description: A page of people. ContentMetadataResponse: type: object properties: dateFormat: type: string dateTimeFormat: type: string paginationToken: type: string nullable: true additionalProperties: false UserSummaryResponse: type: object properties: principalId: type: string description: >- The person's stable identifier on this platform. Address them with it on every `/users/{principalId}` route. email: type: string description: The address they sign in with. nullable: true givenName: type: string description: Their first name, as invited. nullable: true familyName: type: string description: Their last name, as invited. nullable: true accountState: enum: - unknown - invited - active - disabled type: string description: >- `invited` until they first sign in, `active` once they have, `disabled` when their sign-in has been switched off, and `unknown` when the identity directory could not be reached for this row. Somebody linked to an identity provider is `active` from the start: there is no invitation to accept. detailsAvailable: type: boolean description: >- False when the identity directory did not answer for this person. Their name and email address are then the last values stored and may be out of date or absent. The row is still returned. invitedDate: type: string description: When they were first given access to this account. nullable: true accessType: enum: - Customer - Guest type: string description: >- `Customer` for one of the account's own people; `Guest` for somebody from another business who reaches organisations here by invitation. A guest row shows only the access this account granted, and their account is not this account's to manage. signInProviders: type: array items: type: string description: >- The identity providers this person signs in through, by name. Empty or absent when they sign in with a password. nullable: true passwordSignIn: type: string description: >- `Denied` when they sign in through their identity provider alone: no temporary password was issued, the invitation cannot be resent, and there is nothing to reset. `Allowed` when they have a password. Absent on accounts created before sign-in was recorded. nullable: true additionalProperties: false description: One person in your account. securitySchemes: X-Auth-Token: type: apiKey description: FlowPayroll JWT (raw token, no Bearer prefix) name: X-Auth-Token in: header ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.