Retrieves a paginated list of users for the tenant. Supports filtering by modification date range, location IDs, brand names, and email addresses. Use the continuationToken from the previous response to retrieve the next page.
Security
The requesting user must have the following permission to retrieve users:
- Administration → Users → View Users
For API-managed users, permissions are assigned through the API rather than the UI — see the API Managed Users article.
Permission-change latency: changes to permissions take several minutes to propagate. A user may continue to see the previous permission set's results for a short period after a permission is granted or removed.
Identifies the R365 tenant the request applies to. Required on every request.
Modified after
Modified before
Locations IDs to filter by (comma-separated)
Maximum number of top-level objects to return in one page.
Brands names to filter by (comma-separated)
User emails to filter by (comma-separated)
Pagination token returned from a previous response. Omit to start from the first page
Users
Unique identifier of the user.
Unique identifier of the location.
Display name of the location.
Number assigned to the location.
Indicates whether the user is inactive.
Unique identifier of the role.
Display name of the role.
Unique identifier of the role.
Display name of the role.
Locations the user may access. OMITTED FROM THE RESPONSE ENTIRELY when allLocationsAccess is true — do not rely on it being present.
Unique identifier of the location.
Display name of the location.
Number assigned to the location.
Unique identifier of the location.
Display name of the location.
Number assigned to the location.
Unique identifier of the option with location group.
Unique identifier of the entity reference long.
Display name of the entity reference long.
Brand that manages this user, or null when the user is not brand-managed.
Reference to the employee record a user is linked to.
Legal entities the user is scoped to, or null when not scoped by legal entity.
Legal entity a user is scoped to.
URL to retrieve the next page of results, or null when this is the last page.
Bad Request — a parameter value is malformed, of the wrong type, or outside its allowed range.
Unauthorized — the bearer token is missing, invalid or expired, or is not valid for the specified tenant.
Forbidden — the caller lacks the permission required for this operation.
Not Found — the requested resource does not exist, or the supplied continuation token is unknown or has expired.
Conflict — the request conflicts with the current state of the resource and cannot be applied.
Unprocessable Entity — a required parameter is missing, or a supplied parameter value is invalid.
Too Many Requests — the caller has exceeded the rate limit; retry after a short delay.
Internal Server Error — an unexpected error occurred while processing the request.