> ## Documentation Index > Fetch the complete documentation index at: https://developers.primulamanagement.com/llms.txt > Use this file to discover all available pages before exploring further. # List users > Scoped to company_id; the handler does not restrict this read to the session school assignments. Without email, returns users sorted by updated_at and optionally filters to updated_at strictly after updated_after. When email is supplied, returns zero or one matching user in an array; updated_after is ignored and not validated in that branch. ## OpenAPI ````yaml /openapi.yaml get /users openapi: 3.1.0 info: title: Primula Tracker API V3 version: 3.0.0 description: >- Reference for the 66 operations registered under `/primula/api/v3` in the V3 release baseline. ## Authentication Create a session with `POST /sessions`, then send `Authorization: Bearer ` on protected operations. Tokens must remain associated with a valid server-side session. The returned refresh token has no refresh endpoint in V3. Session company and school restrictions are documented per operation; company_id is not inferred from the token. ## Responses and errors Collections generally return bare JSON arrays and items return bare JSON objects. Report objects, nested maps, and update summaries are explicitly described below. List metadata travels in response headers rather than an envelope. Empty lists written by collection helpers are `[]`; fields backed by nullable values may be `null`, and omitted properties are distinguished from null properties in schemas. Handlers generally return `{ "error": "message" }`; authentication middleware and activity proxy errors use plain text. Unsupported methods on a registered path return 405 with Allow after any applicable authentication checks. ## Pagination and projections Only operations documenting page/per_page support pagination. Defaults are page=1 and per_page=100. Values exceeding the documented effective cap are clamped, not rejected. X-Total-Count describes the full matching set. Link contains applicable navigation links and is omitted for a single page. Aggregates use limit (default 50, effective cap 200) instead of pagination and send X-Truncated only when rows were omitted. The fields parameter, where available, selects the exact response properties; unsupported fields return 400. ## Query encoding Multi-value parameters documented as arrays accept repeated keys or comma-separated values. Prefer repeated keys for long UUID lists. Except for the two activity proxy operations, query parsing drops the entire query string above 8192 bytes and truncates each decoded query value to 128 bytes. Parameter combinations and interpretation differ by resource and representation; consult each operation. Unknown parameters are rejected only where explicitly documented. ## Dates and writes Calendar dates use YYYY-MM-DD, monthly periods use YYYY-MM, and timestamp formats are described in the corresponding schema. Defaults such as today depend on the server clock. PATCH operations change only the documented properties and reject unknown body properties. Clearing values, authorization, and partial-write behavior vary by resource and are described per operation. Examples use synthetic identifiers and placeholder tokens. Replace the server host before using an interactive API client. servers: - url: https://{host}/primula/api/v3 description: V3 API deployment. Replace the placeholder hostname. variables: host: default: api.example.com security: - bearerAuth: [] tags: - name: sessions description: Sessions. - name: schools description: Schools. - name: companies description: Companies. - name: rooms description: Rooms. - name: users description: Users. - name: gusto_companies description: Gusto companies. - name: gusto_employees description: Gusto employees. - name: gusto_contractors description: Gusto contractors. - name: gusto_payrolls description: Gusto payrolls. - name: procare_staff description: Procare staff. - name: efficiency_ratios description: Efficiency ratios. - name: enrollment_tracker description: Enrollment tracker. - name: classroom_attendance description: Classroom attendance. - name: absences description: Absences. - name: billing_attendance_audits description: Billing attendance audits. - name: data_refresh description: Data refresh. - name: waitlist description: Waitlist. - name: sibling_discounts description: Sibling discounts. - name: new_start_tracker description: New start tracker. - name: withdrawal_tracker description: Withdrawal tracker. - name: transition_tracker description: Transition tracker. - name: enrollments description: Enrollments. - name: pre_registration_fallout description: Pre registration fallout. - name: procare_messages description: Procare messages. - name: activities_summary description: Activities summary. - name: activity_details description: Activity details. - name: leads description: Leads. - name: students description: Students. - name: payments description: Payments. - name: family_balances description: Family balances. - name: attendances description: Attendances. - name: billing_plans description: Billing plans. - name: spaces description: Spaces. paths: /users: get: tags: - users summary: List users description: >- Scoped to company_id; the handler does not restrict this read to the session school assignments. Without email, returns users sorted by updated_at and optionally filters to updated_at strictly after updated_after. When email is supplied, returns zero or one matching user in an array; updated_after is ignored and not validated in that branch. operationId: GetUsersV3 parameters: - $ref: '#/components/parameters/CompanyId' - name: email in: query required: false description: Exact email lookup; takes precedence over updated_after. schema: type: string format: email example: user@example.com - name: updated_after in: query required: false description: >- Only users whose non-null updated_at is strictly later than this RFC3339 timestamp; applies only without email. schema: type: string format: date-time example: '2026-01-01T00:00:00Z' responses: '200': description: Successful response. content: application/json: schema: type: array items: $ref: '#/components/schemas/User' example: [] headers: X-Total-Count: $ref: '#/components/headers/TotalCount' '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '405': $ref: '#/components/responses/405' '500': $ref: '#/components/responses/500' components: parameters: CompanyId: name: company_id in: query required: true description: >- Company UUID. Must equal the authenticated session company when that session has a company assigned; the equality check is skipped for sessions without one. schema: type: string format: uuid example: 11111111-1111-4111-8111-111111111111 schemas: User: type: object properties: id: type: string username: type: string name: type: string first_name: type: string last_name: type: string email: type: string groups: type: - array - 'null' items: type: string school_ids: type: - array - 'null' items: type: string is_active: type: boolean updated_at: type: - string - 'null' format: date-time required: - id - username - name - first_name - last_name - email - groups - school_ids - is_active - updated_at description: User. Error: type: object properties: error: type: string description: Human-readable error message. required: - error description: Error. headers: TotalCount: description: >- Total matching rows before pagination, or matching groups before the aggregate limit. For unpaginated arrays, the number of returned rows. schema: type: integer minimum: 0 example: 125 responses: '400': description: Invalid or missing parameters or request body. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: Invalid or missing parameters or request body. '401': description: >- Missing or invalid Bearer token, or an absent, invalid or expired server-side session. The authentication middleware returns plain text with a trailing newline. content: text/plain: schema: type: string examples: missing: value: | missing authorization header invalid: value: | Unauthorized expired: value: | Session expired '403': description: The authenticated session is not allowed to perform this operation. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: >- The authenticated session is not allowed to perform this operation. '405': description: The path exists but does not support this HTTP method. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: The path exists but does not support this HTTP method. headers: Allow: description: Comma-separated HTTP methods accepted by this path. schema: type: string '500': description: The operation could not be completed. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: The operation could not be completed. securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- Access token issued by POST /sessions and associated with a valid server-side session. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.