{"type":"api","title":"Search Users of your org","meta":{"id":"/apps/pubhub/media/cisco-xdr-api-docs/f4e065ff5977829c89df289df08411f83205f526/ab3b1f5d-ecd3-3161-8d4d-1f97576dc981","info":{"title":"IROH User Web Service","description":"API to Manage User Infos.","contact":{"name":"Cisco Security Business Group -- Advanced Threat","email":"cisco-intel-api-support@cisco.com"},"license":{"name":"All Rights Reserved","url":"https://www.cisco.com"},"version":"1.0.107"},"security":[{"oAuth2":["integration:read","private-intel:read","profile:read","inspect:read","users:read","invite:read","enrich:read","oauth:read","response:read","global-intel:read","ao:read","playbook:read"]}],"tags":[{"name":"UserClient","description":"User Operations"}],"x-parser-conf":{"serverConfig":"select","overview":{"markdownPath":"reference/user/overview.md","uri":"user-api-guide"},"disableAuthEditing":true,"exampleAsDefault":true,"oAuth2":{"clientId":"client-546e34fc-c6bf-4951-ac69-f6d7987a7814","clientSecret":"MYw4_E_tBdFwUwrX6WFYKVD5LQrG2k7XrJ5J046wWE0s1gAKCxJ8VA","proxyEnabled":false},"meta":{"useProxy":true}},"openapi":"3.0.1","servers":[{"url":"https://visibility.amp.cisco.com"}],"securitySchemes":{"oAuth2":{"type":"oauth2","flows":{"clientCredentials":{"tokenUrl":"https://visibility.amp.cisco.com/iroh/oauth2/token","scopes":{"telemetry":"Collect application data for analytics","integration:read":"Manage your modules","private-intel:read":"Access Private Intelligence","admin":"Provide admin privileges","cognitive":"Cognitive Integration","profile:read":"Get your profile information","inspect:read":"Extract Observables and data from text","asset":"Access and modify your assets","event":"Read IROH Events","feedback":"Submit Customer Feedback","sse":"SSE Integration. Manage your Devices.","registry":"Manage registry entries","users:read":"Manage users of your organization","investigation":"Perform threat analysis investigation","invite:read":"Invite users into your organization","casebook":"Access and modify your casebooks","playbook":"Access and modify your playbooks","orbital":"Orbital Integration.","enrich:read":"Query your configured modules for threat intelligence","oauth:read":"Manage OAuth2 Clients","vault":"Grants access to Module Vaults","response:read":"List and execute response actions using configured modules","notification":"Receive notifications from integrations","global-intel:read":"Access AMP Global Intelligence","webhook":"Manage your Webhooks","ao:read":"AO Integration."}}}}}},"spec":{"tags":["User"],"summary":"Search Users of your org","description":"[required scopes](/iroh/doc/iroh-auth/#scopes): `users/search:read`\n\n**Search users**\n\nMatches by providing a JSON structure.\n\n**Example:** `{:scopes [\"admin\"]}` will matches all users having an `admin` scope.\n\n**Links**:\n - [Data Model](/iroh/doc/iroh-auth/#data-model)","parameters":[{"name":"sort_by","in":"query","description":"Sort results on a field","schema":{"type":"string"}},{"name":"sort_order","in":"query","description":"Sort direction","schema":{"type":"string","enum":["desc","asc"]}},{"name":"offset","in":"query","description":"Pagination Offset","schema":{"type":"integer","format":"int64"}},{"name":"limit","in":"query","description":"Pagination Limit","schema":{"type":"integer","format":"int64"}},{"name":"query","in":"query","description":"deprecated: use match","schema":{"type":"string"}},{"name":"match","in":"query","description":"Text match search","schema":{"type":"string"}}],"requestBody":{"description":"Will match all object matching this object (a bit like with MongoDB)","content":{"application/json":{"schema":{"type":"object","properties":{"user-id":{"type":"string"},"user-name":{"type":"string"},"user-email":{"type":"string"},"user-nick":{"type":"string"},"enabled?":{"type":"boolean"},"role":{"type":"string","enum":["user","admin","sat"]},"scopes":{"type":"object"}},"additionalProperties":false,"$$ref":"#/components/schemas/UserFilterMap"}},"application/x-yaml":{"schema":{"type":"object","properties":{"user-id":{"type":"string"},"user-name":{"type":"string"},"user-email":{"type":"string"},"user-nick":{"type":"string"},"enabled?":{"type":"boolean"},"role":{"type":"string","enum":["user","admin","sat"]},"scopes":{"type":"object"}},"additionalProperties":false,"$$ref":"#/components/schemas/UserFilterMap"}},"application/edn":{"schema":{"type":"object","properties":{"user-id":{"type":"string"},"user-name":{"type":"string"},"user-email":{"type":"string"},"user-nick":{"type":"string"},"enabled?":{"type":"boolean"},"role":{"type":"string","enum":["user","admin","sat"]},"scopes":{"type":"object"}},"additionalProperties":false,"$$ref":"#/components/schemas/UserFilterMap"}},"application/transit+json":{"schema":{"type":"object","properties":{"user-id":{"type":"string"},"user-name":{"type":"string"},"user-email":{"type":"string"},"user-nick":{"type":"string"},"enabled?":{"type":"boolean"},"role":{"type":"string","enum":["user","admin","sat"]},"scopes":{"type":"object"}},"additionalProperties":false,"$$ref":"#/components/schemas/UserFilterMap"}},"application/transit+msgpack":{"schema":{"type":"object","properties":{"user-id":{"type":"string"},"user-name":{"type":"string"},"user-email":{"type":"string"},"user-nick":{"type":"string"},"enabled?":{"type":"boolean"},"role":{"type":"string","enum":["user","admin","sat"]},"scopes":{"type":"object"}},"additionalProperties":false,"$$ref":"#/components/schemas/UserFilterMap"}}},"required":false},"responses":{"200":{"description":"","content":{"application/json":{"schema":{"type":"array","items":{"required":["created-at","enabled?","org-id","role","scopes","user-id"],"type":"object","properties":{"role":{"type":"string","enum":["user","admin","master","sat"]},"scopes":{"uniqueItems":true,"type":"array","items":{"type":"string"}},"user-email":{"type":"string"},"user-name":{"type":"string"},"org-id":{"type":"string"},"user-id":{"type":"string"},"enabled?":{"type":"boolean"},"additional-scopes":{"uniqueItems":true,"type":"array","items":{"type":"string"}},"created-at":{"type":"string","format":"date-time"},"user-nick":{"type":"string"}},"additionalProperties":false,"$$ref":"#/components/schemas/UserPublicUser"}}},"application/x-yaml":{"schema":{"type":"array","items":{"required":["created-at","enabled?","org-id","role","scopes","user-id"],"type":"object","properties":{"role":{"type":"string","enum":["user","admin","master","sat"]},"scopes":{"uniqueItems":true,"type":"array","items":{"type":"string"}},"user-email":{"type":"string"},"user-name":{"type":"string"},"org-id":{"type":"string"},"user-id":{"type":"string"},"enabled?":{"type":"boolean"},"additional-scopes":{"uniqueItems":true,"type":"array","items":{"type":"string"}},"created-at":{"type":"string","format":"date-time"},"user-nick":{"type":"string"}},"additionalProperties":false,"$$ref":"#/components/schemas/UserPublicUser"}}},"application/edn":{"schema":{"type":"array","items":{"required":["created-at","enabled?","org-id","role","scopes","user-id"],"type":"object","properties":{"role":{"type":"string","enum":["user","admin","master","sat"]},"scopes":{"uniqueItems":true,"type":"array","items":{"type":"string"}},"user-email":{"type":"string"},"user-name":{"type":"string"},"org-id":{"type":"string"},"user-id":{"type":"string"},"enabled?":{"type":"boolean"},"additional-scopes":{"uniqueItems":true,"type":"array","items":{"type":"string"}},"created-at":{"type":"string","format":"date-time"},"user-nick":{"type":"string"}},"additionalProperties":false,"$$ref":"#/components/schemas/UserPublicUser"}}},"application/transit+json":{"schema":{"type":"array","items":{"required":["created-at","enabled?","org-id","role","scopes","user-id"],"type":"object","properties":{"role":{"type":"string","enum":["user","admin","master","sat"]},"scopes":{"uniqueItems":true,"type":"array","items":{"type":"string"}},"user-email":{"type":"string"},"user-name":{"type":"string"},"org-id":{"type":"string"},"user-id":{"type":"string"},"enabled?":{"type":"boolean"},"additional-scopes":{"uniqueItems":true,"type":"array","items":{"type":"string"}},"created-at":{"type":"string","format":"date-time"},"user-nick":{"type":"string"}},"additionalProperties":false,"$$ref":"#/components/schemas/UserPublicUser"}}},"application/transit+msgpack":{"schema":{"type":"array","items":{"required":["created-at","enabled?","org-id","role","scopes","user-id"],"type":"object","properties":{"role":{"type":"string","enum":["user","admin","master","sat"]},"scopes":{"uniqueItems":true,"type":"array","items":{"type":"string"}},"user-email":{"type":"string"},"user-name":{"type":"string"},"org-id":{"type":"string"},"user-id":{"type":"string"},"enabled?":{"type":"boolean"},"additional-scopes":{"uniqueItems":true,"type":"array","items":{"type":"string"}},"created-at":{"type":"string","format":"date-time"},"user-nick":{"type":"string"}},"additionalProperties":false,"$$ref":"#/components/schemas/UserPublicUser"}}}}}},"x-no-doc":false,"x-codegen-request-body-name":"UserFilterMap","security":[{"oAuth2":["integration:read","private-intel:read","profile:read","inspect:read","users:read","invite:read","enrich:read","oauth:read","response:read","global-intel:read","ao:read","playbook:read"]}],"method":"post","path":"/iroh/user-mgmt/search/users"}}