List users (for assignment pickers and member management)
GET/api/users
List users (for assignment pickers and member management). Pass ?email=<exact-match> to look up a single user by email — used by the MCP / pt CLI assignee resolver to translate the INF-125 agent-claim convention email (agent+<class>@constellation.local) into a UUID. Both modes are tenant-scoped to the caller’s active organisation; cross-tenant matches are never returned. Membership is not required: the listing is keyed on identity.users.tenant_id, not on user_tenant_memberships, so it returns synthetic agent users whether or not they hold a membership row (customer tenants carry none; the dogfood tenant keeps deliberate org-scoped ones — DIR-69). That is why the assignee resolver reads this endpoint rather than the membership-scoped /api/people. Note the listing is not filtered by status, so soft-deleted and suspended users still appear (the ?email= lookup does filter them).
Request
Responses
- 200
- 401
- 403
Successful response
Unauthorized — authentication credentials are missing or invalid
Forbidden, for either of two reasons. (a) The x-act-as-org selector named an organisation the caller is not an ACTIVE member of — getCurrentUser() throws OrgOverrideForbiddenError, which withErrorHandler renders as the canonical envelope. (b) The caller has no active organisation at all (code: "NO_ACTIVE_ORG"), so no tenant scope can be resolved — both modes fail closed rather than fall back to an unscoped listing. Before INF-323 the listing branch queried identity.users with no tenant scope at all, which under the enforced non-bypass RLS role silently returned zero rows and made the MCP reject every valid assignee UUID. This route has NO permission gate, so a 403 here is never a missing-permission denial — those are the only two paths.