# List users

> Retrieve a list of all users.

> For the complete documentation index, see [llms.txt](https://helpdesk.orangescrum.com/llms.txt).

Source: https://helpdesk.orangescrum.com/guide/api/endpoints/users/users-list

---
`POST /api/v1/partner/users/list`

Retrieve a list of all users. This endpoint requires no payload, only authentication headers. All data must be encrypted in the request body. Response returns decrypted JSON data. This is a read-only endpoint.

## Authorizations

- `X-API-KEY` *string* (required) — Developer API key (starts with pk_)

- `X-TIMESTAMP` *integer* (required) — Unix timestamp in seconds (must be within ±5 minutes of server time)

- `X-NONCE` *string* (required) — One-time random string (minimum 8 characters, prevents replay attacks)

- `X-SIGNATURE` *string* (required) — HMAC-SHA256 signature of canonical string (hex-encoded)

## Headers

- `Accept` *string* (required) — Content type for response

- `Content-Type` *string* (required) — Content type for request

## Request body

Encrypted request data containing optional filter parameters

- `encrypted_data` *string* (required) — Base64-encoded encrypted JSON data. Encryption: AES-256-CBC with 16-byte IV prepended. Key: SHA256 hash of secret key.

## Responses

- **200** — Users retrieved successfully

- **400** — Bad request - Invalid filters

- **401** — Unauthorized - Invalid or missing API key

- **500** — Server error
## Request samples

### cURL

```bash
curl -X POST 'https://v4-api.orangescrum.com/api/v1/partner/users/list' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -H 'X-API-KEY: pk_your_api_key' \
  -H 'X-TIMESTAMP: '"$(date +%s)" \
  -H 'X-NONCE: '"$(openssl rand -hex 8)" \
  -H 'X-SIGNATURE: <hmac-sha256>' \
  -d '{"encrypted_data":"<base64-aes-256-cbc-payload>"}'
```

### Python

```python
# call() is defined on the Authentication page.
from orangescrum import call

response = call(
    "/api/v1/partner/users/list",
    {},
)
print(response)
```

### JavaScript

```javascript
// call() is defined on the Authentication page.
import { call } from './orangescrum.js';

const response = await call('/api/v1/partner/users/list', {});
console.log(response);
```

### PHP

```php
<?php
// call() is defined on the Authentication page.
require 'orangescrum.php';

$response = call('/api/v1/partner/users/list', json_decode('{}', true));
print_r($response);
```

## Example response

```json
{
  "success": true,
  "message": "Users retrieved successfully",
  "data": [
    {
      "user_id": "USR-001",
      "name": "John Doe",
      "email": "john.doe@example.com",
      "mobile": "+1234567890",
      "designation": "Senior Developer",
      "profile_pic": "https:
      "is_active": true,
      "created_at": "2024-01-10 10:30:00",
      "updated_at": "2024-01-20 14:25:00"
    }
  ]
}
```