List all users (admin only)
GET
/users
Returns all user accounts sorted alphabetically. Includes login tracking fields (last_sign_in_at, failed_attempts, locked_at) for admin monitoring. Requires admin role — returns 403 for non-admin users.
Authorizations
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Responses
All user accounts
application/json
JSON { "id": 1, "name": "Demo Admin", "email": "admin@example.com", "provider": null, "admin": true, "last_sign_in_at": "2026-05-28T15:00:00Z", "failed_attempts": 0, "locked_at": null }, { "id": 5, "name": "Bernice Deckow", "email": "bernice.deckow@example.com", "provider": null, "admin": false, "last_sign_in_at": null, "failed_attempts": 0, "locked_at": null }
[
]