> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Portal Users

> Retrieve data for all users registered on the ThreatAware platform

## Overview

The Portal Users endpoint provides access to user accounts that have been created within the ThreatAware platform itself (not to be confused with the `/users` endpoint which returns user data from integrated directory services).

<Info>
  **Difference from `/users` endpoint:**

  * `/users` - Returns user data from Active Directory, Azure AD, etc. (directory services)
  * `/settings/usermanagement/users` - Returns ThreatAware portal user accounts
</Info>

## Parameters

<ParamField query="offset" type="number" default="0">
  Set the start position of the data returned by the API
</ParamField>

<ParamField query="limit" type="number" default="0">
  Limit each request by the provided number. Leave blank or as 0 to return all data available
</ParamField>

## Authentication

<ParamField header="X-ThreatAware-ApiKey" type="string" required>
  Your ThreatAware API key
</ParamField>

<ParamField header="Accept" type="string" default="application/json">
  Response format
</ParamField>

## Response

<ResponseField name="offset" type="number">
  The starting position of this result set
</ResponseField>

<ResponseField name="limit" type="number">
  The number of results returned
</ResponseField>

<ResponseField name="total" type="number">
  Total number of portal users
</ResponseField>

<ResponseField name="success" type="boolean">
  Whether the request was successful
</ResponseField>

<ResponseField name="statusCode" type="number">
  HTTP status code
</ResponseField>

<ResponseField name="message" type="string">
  Status message
</ResponseField>

<ResponseField name="data" type="array">
  <Expandable title="Portal User Object">
    <ResponseField name="username" type="string">
      Email address / username
    </ResponseField>

    <ResponseField name="name" type="string">
      First name
    </ResponseField>

    <ResponseField name="surname" type="string">
      Last name
    </ResponseField>

    <ResponseField name="roleid" type="string">
      Role identifier (e.g., `superAdmin`, `analyst`, `viewer`)
    </ResponseField>

    <ResponseField name="mfastatus" type="string">
      MFA status: `enabled` or `disabled`
    </ResponseField>

    <ResponseField name="enabled" type="boolean">
      Whether the user account is active
    </ResponseField>

    <ResponseField name="ssostatus" type="string">
      SSO status: `enabled` or `disabled`
    </ResponseField>

    <ResponseField name="currentteams" type="array">
      Teams this user belongs to

      <Expandable title="Team Object">
        <ResponseField name="id" type="string">
          Team ID
        </ResponseField>

        <ResponseField name="name" type="string">
          Team name
        </ResponseField>
      </Expandable>
    </ResponseField>
  </Expandable>
</ResponseField>

<RequestExample>
  ```bash cURL theme={null}
  curl --location 'https://your-cloud-id.threataware.com/public-api/v1/settings/usermanagement/users?limit=10' \
    --header 'Accept: application/json' \
    --header 'X-ThreatAware-ApiKey: your-api-key-here'
  ```

  ```python Python theme={null}
  import requests

  API_KEY = "your-api-key-here"
  CLOUD_ID = "sandbox"
  BASE_URL = f"https://{CLOUD_ID}.threataware.com/public-api/v1"

  headers = {
      "Accept": "application/json",
      "X-ThreatAware-ApiKey": API_KEY
  }

  response = requests.get(
      f"{BASE_URL}/settings/usermanagement/users",
      headers=headers,
      params={"limit": 10}
  )

  users = response.json()
  print(f"Retrieved {len(users['data'])} portal users")

  # Example: Find users without MFA
  no_mfa = [u for u in users['data'] if u['mfastatus'] != 'enabled']
  print(f"Users without MFA: {len(no_mfa)}")
  ```

  ```javascript Node.js theme={null}
  const axios = require('axios');

  const API_KEY = 'your-api-key-here';
  const CLOUD_ID = 'sandbox';
  const BASE_URL = `https://${CLOUD_ID}.threataware.com/public-api/v1`;

  axios.get(`${BASE_URL}/settings/usermanagement/users`, {
    headers: {
      'Accept': 'application/json',
      'X-ThreatAware-ApiKey': API_KEY
    },
    params: { limit: 10 }
  })
    .then(response => {
      console.log(`Retrieved ${response.data.data.length} portal users`);
    });
  ```

  ```powershell PowerShell theme={null}
  $ApiKey = "your-api-key-here"
  $CloudId = "sandbox"
  $BaseUrl = "https://$CloudId.threataware.com/public-api/v1"

  $Headers = @{
      "Accept" = "application/json"
      "X-ThreatAware-ApiKey" = $ApiKey
  }

  $Response = Invoke-RestMethod `
      -Uri "$BaseUrl/settings/usermanagement/users?limit=10" `
      -Headers $Headers `
      -Method Get

  Write-Host "Retrieved $($Response.data.Count) portal users"
  ```
</RequestExample>

<ResponseExample>
  ```json 200 OK theme={null}
  {
    "offset": 0,
    "limit": 1,
    "total": 10,
    "data": [
      {
        "username": "sara.harris@company.com",
        "name": "Sara",
        "surname": "Harris",
        "roleid": "analyst",
        "mfastatus": "enabled",
        "enabled": true,
        "ssostatus": "enabled",
        "currentteams": [
          {
            "id": "e0dc1b5d-61ef-4b6f-9603-2e19f0f69ab4",
            "name": "Asset Governance"
          },
          {
            "id": "d1ae6609-2bbc-480c-a484-4b271f54e2ba",
            "name": "IT Service Desk"
          },
          {
            "id": "a84d8017-8705-4c6d-ae73-ea2b87dc9c9c",
            "name": "SecOps"
          },
          {
            "id": "f726d4d6-c9be-4d45-b5ec-2a9b70a8589f",
            "name": "Data Compliance"
          }
        ]
      }
    ],
    "success": true,
    "statusCode": 200,
    "message": "Successfully retrieved users."
  }
  ```
</ResponseExample>

## Use Cases

<CardGroup cols={2}>
  <Card title="User Access Auditing" icon="user-shield">
    Track who has access to the ThreatAware portal and their permissions
  </Card>

  <Card title="MFA Compliance" icon="shield-check">
    Identify portal users without MFA enabled
  </Card>

  <Card title="Team Membership" icon="users">
    Export user-to-team mappings for access reviews
  </Card>

  <Card title="SSO Adoption" icon="right-to-bracket">
    Monitor SSO enablement across portal users
  </Card>
</CardGroup>

## Related Endpoints

<CardGroup cols={2}>
  <Card title="Get Roles" icon="user-tag" href="/api-reference/settings-roles">
    Retrieve role definitions and permissions
  </Card>

  <Card title="Get Teams" icon="users" href="/api-reference/settings-teams">
    Retrieve team definitions and members
  </Card>
</CardGroup>