`get_users`

Read-only

Calls GET /api/users as the signed-in person · REST reference

List the users of the caller's organizations

ORG-SCOPED by admin.users.view: a caller sees the users of the organizations in which it holds that feature (not merely belongs to), a caller holding a PFF-exclusive permission sees every organization's, and a caller holding it nowhere is refused 403. Each row's organizations and groups list only the organizations the caller may view (org.view, admin.groups.view) — a member of two orgs does not reveal the other org to the first one's admins. The boundary is the DAL's orgScope, resolved from the caller's OWN forwarded bearer token against the graph and applied inside the query, so it cannot be widened from the request. There is no filtering, no pagination and no query parameter of any kind. UserService.getAllUsers asks the DAL for limit: 1000, so the 1001st user in scope is silently absent. THE SHAPE IS A BARE ARRAY, with no count and no envelope — unlike GET /api/orgs (object with organizations) and unlike GET /api/groups / GET /api/roles ({ success, data }). Timestamps come straight off the DAL entity and are epoch MILLISECONDS. organizations here is the MEMBERSHIP sense ({ id, name, type }), which is a different shape from the organizations on the authenticated principal (OrgMembership).

Arguments

This tool takes no arguments.

Example call

A client sends this over the MCP session; Claude and other agents build it for you. The values are placeholders — the shape is real.

json

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "get_users",
    "arguments": {}
  }
}

Result

On success (HTTP 200) the tool returns one text item holding the API's JSON, pretty-printed.

The users inside the caller's organization scope, each with the orgs and groups they belong to.

json

[
  {
    "createdAt": 1,
    "deleted": true,
    "email": "string",
    "emailVerified": true,
    "firstName": "string",
    "id": "string",
    "lastName": "string",
    "mfaEnabled": true,
    "status": "ACCEPTED",
    "acceptedAt": 1,
    "deletedAt": 1,
    "deletedBy": "string",
    "invitedAt": 1,
    "lastLoginAt": 1
  }
]

Fields

Field	Type	Description
`[].acceptedAt`	number \| null
`[].createdAt`	number
`[].deleted`	boolean
`[].deletedAt`	number \| null
`[].deletedBy`	string \| null
`[].email`	string
`[].emailVerified`	boolean
`[].firstName`	string
`[].id`	string
`[].invitedAt`	number \| null
`[].lastLoginAt`	number \| null
`[].lastName`	string
`[].metadata`	object \| null
`[].mfaEnabled`	boolean
`[].phone`	string \| null
`[].status`	"ACCEPTED" \| "ACTIVE" \| "APPROVED" \| "DELETED" \| "DONOR_ONLY" \| "INVITED" \| … (9 values)
`[].suspendedAt`	number \| null
`[].groups`	array of object
`[].groups[].id`	string (uuid)
`[].groups[].name`	string
`[].groups[].orgId`	string (uuid) \| null
`[].organizations`	array of object
`[].organizations[].id`	string (uuid)
`[].organizations[].name`	string
`[].organizations[].type`	string

When it fails

A failed call returns isError: true with the API's message as text.

403: Authenticated, but the caller holds none of the required permissions.

What the model is shown

This is the tool exactly as the server lists it in tools/list. The description starts with the REST call it makes.

json

{
  "name": "get_users",
  "description": "GET /api/users — ORG-SCOPED by `admin.users.view`: a caller sees the users of the organizations in which it holds that feature (not merely belongs to), a caller holding a PFF-exclusive permission sees every organization's, and a caller holding it nowhere is refused 403. Each row's `organizations` and `groups` list only the organizations the caller may view (`org.view`, `admin.groups.view`) — a member of two orgs does not reveal the other org to the first one's admins. The boundary is the DAL's `orgScope`, resolved from the caller's OWN forwarded bearer token against the graph and applied inside the query, so it cannot be widened from the request. There is no filtering, no pagination and no query parameter of any kind. `UserService.getAllUsers` asks the DAL for `limit: 1000`, so the 1001st user in scope is silently absent. THE SHAPE IS A BARE ARRAY, with no `count` and no envelope — unlike `GET /api/orgs` (object with `organizations`) and unlike `GET /api/groups` / `GET /api/roles` (`{ success, data }`). Timestamps come straight off the DAL entity and are epoch MILLISECONDS. `organizations` here is the MEMBERSHIP sense (`{ id, name, type }`), which is a different shape from the `organizations` on the authenticated principal (`OrgMembership`).",
  "inputSchema": {
    "type": "object",
    "properties": {}
  },
  "annotations": {
    "readOnlyHint": true,
    "openWorldHint": false
  }
}