This endpoint retrieves a list of users associated with a specific application. Supports advanced filtering, pagination, sorting, and search.

Supported Filter Fields:

License Mapped Filter: To filter users based on license assignment status:

{
  "field_id": "license_mapped",
  "field_values": [true]
}

• [true] - Shows only users who have licenses assigned
• [false] - Shows only users who do not have licenses assigned
• If not applied - Shows all users (both licensed and unlicensed)

Source Array Filter Format: For filtering by source information (integrations, agents, etc.), use the following format:

Manual Source Filter:

{
  "field_id": "source_array",
  "field_values": [
    {
      "key": "keyword",
      "value": ["manual"],
      "value_type": "string"
    }
  ],
  "is_only": false
}

Integration Source Filter:

{
  "field_id": "source_array",
  "negative": false,
  "field_values": [
    {
      "key": "org_integration_id",
      "value_type": "objectId",
      "value": ["681047a5b5c755b83e0ff982"]
    }
  ],
  "is_only": false
}

Available Source Keys:

• keyword - Source keyword (e.g., "manual", "okta", "slack")
• org_integration_id - Organization integration ID
• global_agent_id - Global agent ID

Date Range Filter Format: For filtering by date/time fields, use the field_order parameter to specify comparison operators:

Date Range Filter (Between two dates):

{
  "field_id": "user_app_last_used",
  "field_values": ["2025-11-12", "2025-11-13"],
  "field_order": ["gte", "lte"]
}

Single Date Comparison:

{
  "field_id": "user_app_discovered",
  "field_values": ["2025-11-12"],
  "field_order": ["gte"]
}

Available Field Order Operators:

• gte - Greater than or equal to
• lte - Less than or equal to
• eq - Equal to
• ne - Not equal to
• lt - Less than
• gt - Greater than

Custom Fields Filter Format: For filtering by custom fields, use:

{
  "field_id": "custom_fields",
  "field_values": {
    "custom_field_id": "679b613f315ee0a11cb67bd1",
    "custom_field_values": ["India"]
  }
}