List organization users

GET/usersList organization users

Returns the authenticated organization's members. Creation and deletion of users are managed through the Salfio dashboard's invitation flow and are intentionally not exposed via the API.

Responses

Headers

X-RateLimit-Limit

The request cap for the tighter of the per-organization / per-endpoint windows that applied to this request.

X-RateLimit-Remaining

Requests remaining in the current window.

X-RateLimit-Reset

Unix timestamp (seconds) when the current window resets.

value

allOf · 2 options

Option 1objectEnvelope

datavaluerequired

The response payload — shape depends on the endpoint.

metaobjectrequired

Pagination metadata — populated on list endpoints, empty on single-resource endpoints.

Show child attributes

cursornull | string

Opaque cursor to pass to the next request.

hasMoreboolean | null

True when further pages of results are available.

Option 2object

dataarray of object

Show child attributes

Show array items

Organization user. Identity-bound fields (`email`) are readable but not writable via this API — identity is owned upstream. The spec mentions `phone`, but the current user model does not carry one — tracked as a follow-up.

createdAtstring · date-timerequired

emailstring · emailrequired

Read-only on this API surface.

firstNamestringrequired

idstring · uuidrequired

imageUrlnull | string · uri

lastNamestringrequired

updatedAtstring · date-timerequired

Example response

{
  "data": [
    {
      "createdAt": "2026-06-09T00:00:00Z",
      "email": "alice@acme.com",
      "firstName": "Alice",
      "id": "00000000-0000-0000-0000-000000000000",
      "imageUrl": "https://example.com",
      "lastName": "Morgan",
      "updatedAt": "2026-06-09T00:00:00Z"
    }
  ],
  "meta": {
    "cursor": "string",
    "hasMore": true
  }
}

objectErrorEnvelope

errorobjectrequired

Show child attributes

codestringrequired

Machine-readable error category.

one of "unauthorized", "forbidden", "not_found", "invalid_argument", "conflict", "rate_limited", "internal_error", "not_implemented"

detailsobject

Optional per-code context (field names, retry windows, …).

messagestringrequired

Human-readable description — intended for operator logs, not end-user display.

Example response

{
  "error": {
    "code": "unauthorized",
    "message": "Authentication required"
  }
}

Headers

Retry-After

Seconds the client should wait before retrying.

objectErrorEnvelope

errorobjectrequired

Show child attributes

codestringrequired

Machine-readable error category.

one of "unauthorized", "forbidden", "not_found", "invalid_argument", "conflict", "rate_limited", "internal_error", "not_implemented"

detailsobject

Optional per-code context (field names, retry windows, …).

messagestringrequired

Human-readable description — intended for operator logs, not end-user display.

Example response

{
  "error": {
    "code": "rate_limited",
    "details": {
      "retry_after_seconds": 30
    },
    "message": "Rate limit exceeded"
  }
}

Examples

curl -X GET 'https://api.salfio.com/v1/users'

const response = await fetch('https://api.salfio.com/v1/users', { method: 'GET' });
const data = await response.json();

const response = await fetch('https://api.salfio.com/v1/users', { method: 'GET' });
console.log(await response.json());

import requests

response = requests.request("GET", "https://api.salfio.com/v1/users")
print(response.json())

package main

import (
	"context"
	"net/http"
)

func main() {
	ctx := context.Background()
	req, err := http.NewRequestWithContext(ctx, "GET", "https://api.salfio.com/v1/users", nil)
	if err != nil {
		panic(err)
	}
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()
}

<?php
$request = curl_init("https://api.salfio.com/v1/users");
curl_setopt($request, CURLOPT_CUSTOMREQUEST, "GET");
$response = curl_exec($request);
curl_close($request);

var request = HttpRequest.newBuilder(URI.create("https://api.salfio.com/v1/users"))
    .method("GET", HttpRequest.BodyPublishers.noBody())
    .build();
var response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());

require 'net/http'

uri = URI("https://api.salfio.com/v1/users")
request = Net::HTTPGenericRequest.new("GET", false, true, uri)
response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |http| http.request(request) }

using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Get, "https://api.salfio.com/v1/users");
using var response = await client.SendAsync(request);

{
  "data": [
    {
      "createdAt": "2026-06-09T00:00:00Z",
      "email": "alice@acme.com",
      "firstName": "Alice",
      "id": "00000000-0000-0000-0000-000000000000",
      "imageUrl": "https://example.com",
      "lastName": "Morgan",
      "updatedAt": "2026-06-09T00:00:00Z"
    }
  ],
  "meta": {
    "cursor": "string",
    "hasMore": true
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "Authentication required"
  }
}

{
  "error": {
    "code": "rate_limited",
    "details": {
      "retry_after_seconds": 30
    },
    "message": "Rate limit exceeded"
  }
}

Search documentation

List organization users

Responses

Headers

Headers

Documentation menu