`get_impersonation_users`

Read-only

Calls GET /api/impersonation/users as the signed-in person · REST reference

List accounts that may be impersonated

Requires execute:CreateImpersonationSessionCommand. Returns accounts from the graph - APPROVED only, since a suspended, revoked or invited account is not a legitimate target - with the caller themselves excluded. The page is hard-capped at 100 candidates because each one costs a separate effective-permissions read; there are NO pagination parameters, so an installation with more than 100 approved users cannot see the rest through this endpoint. A candidate whose permissions cannot be read is DROPPED from the list rather than returned with an empty role set, because "no roles" would read as a real answer. The response therefore does not necessarily contain every approved user, and gives no indication that anything was omitted. Rows carry no organization.

Arguments

This tool takes no arguments.

Example call

A client sends this over the MCP session; Claude and other agents build it for you. The values are placeholders — the shape is real.

json

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "get_impersonation_users",
    "arguments": {}
  }
}

Result

On success (HTTP 200) the tool returns one text item holding the API's JSON, pretty-printed.

Up to 100 APPROVED accounts, minus the caller and minus any that failed to resolve.

json

{
  "data": [
    {
      "email": "name@example.org",
      "firstName": "string",
      "id": "11111111-1111-4111-8111-111111111111",
      "lastLogin": 1,
      "lastName": "string",
      "roles": [],
      "status": "string"
    }
  ],
  "success": true
}

Fields

Field	Type	Description
`data`	array of object
`data[].email`	string (email)
`data[].firstName`	string
`data[].id`	string (uuid)
`data[].lastLogin`	integer \| null	Epoch MILLISECONDS straight off the DAL entity, or null when the account has never signed in. An integer, not an ISO string.
`data[].lastName`	string
`data[].roles`	array of string	Distinct ROLE-typed sources of that user's effective permissions.
`data[].status`	string	Always APPROVED - the listing filters on it.
`success`	true

When it fails

A failed call returns isError: true with the API's message as text.

403: Authenticated, but the caller holds none of the required permissions.

What the model is shown

This is the tool exactly as the server lists it in tools/list. The description starts with the REST call it makes.

json

{
  "name": "get_impersonation_users",
  "description": "GET /api/impersonation/users — Requires execute:CreateImpersonationSessionCommand. Returns accounts from the graph - APPROVED only, since a suspended, revoked or invited account is not a legitimate target - with the caller themselves excluded. The page is hard-capped at 100 candidates because each one costs a separate effective-permissions read; there are NO pagination parameters, so an installation with more than 100 approved users cannot see the rest through this endpoint. A candidate whose permissions cannot be read is DROPPED from the list rather than returned with an empty role set, because \"no roles\" would read as a real answer. The response therefore does not necessarily contain every approved user, and gives no indication that anything was omitted. Rows carry no `organization`.",
  "inputSchema": {
    "type": "object",
    "properties": {}
  },
  "annotations": {
    "readOnlyHint": true,
    "openWorldHint": false
  }
}