List company users (roles, locations, accounts)

Overview

List every non-deleted user in the authenticated caller's company with their role, assigned locations and assigned accounts. Only partner (bundle_id=1) and account (bundle_id=3) companies may call it.

Prerequisites

• A bearer token in the Authorization header.

Base URL

Endpoint

GET /api/v1/users/list

Authentication

• Requires a bearer token in the Authorization: Bearer <bearer-token> header.

• Partner / account company-admin — collection bearer token. In-controller gate: the caller's company bundle_id must be 1 or 3, else 403 Only Partner and Account users are allowed.

Rate limit

• No rate limit.

Query parameters

How it works

• 200 returns a data array of users (id, email, verification/active state, name, role, locations, accounts). Not paginated — returns the full company user list.
• 403 when the caller is not a partner/account company.

Response

200 OK · 200

{
  "data": [
    {
      "id": 5,
      "email": "[email protected]",
      "inactive_at": null,
      "email_verified_at": "2026-06-12T06:28:19.000000Z",
      "first_name": "Alex",
      "last_name": "Smith",
      "role": "Basic User",
      "locations": [],
      "accounts": []
    },
    {
      "id": 3,
      "email": "[email protected]",
      "inactive_at": null,
      "email_verified_at": "2026-06-11T10:34:52.000000Z",
      "first_name": "John",
      "last_name": "Doe",
      "role": "Owner",
      "locations": [],
      "accounts": [
        "Acme Brand"
      ]
    }
  ]
}

403 Forbidden · 403

{
  "message": "Forbidden",
  "status": "error",
  "errors": "Only Partner and Account users are allowed."
}

Errors

Example request

curl --request GET \
  --url "https://production-api.shoutaboutus.com/api/v1/users/list?sort_field=last_name&sort_by=ASC" \
  --header 'Authorization: Bearer <bearer-token>' \
  --header 'Accept: application/json'