API: Search user accounts
Two endpoints turn a typed name or e-mail address into a user account. Drive/users/search finds
the people an account can share with, and any account can call it. Core/users/search is for the
administrators, and finds the accounts an administrator can manage. Both take the same parameter
and answer in the same form.
Searching the people to share with
| Target URL | /api.php/Drive/users/search |
| Required scope | share |
| HTTP Method | GET/POST |
| Output format | JSON |
The accounts listed are the ones the account making the request can reach, narrowed by its
Can interact with permission:
- An account created by an independent administrator reaches the other accounts of that administrator, and the administrator itself. An independent administrator reaches the accounts it created. Any other account reaches every account.
- The
Can interact withpermission narrows this to the users and the groups it names. An account it names outside the reach of the account making the request is not listed. When it names nobody, the answer is an empty list.
The request is refused when the account is not allowed to interact with other users.
This endpoint was added in FileRun 2026.4.0.
Searching the accounts as an administrator
| Target URL | /api.php/Core/users/search |
| Required scope | admin |
| HTTP Method | GET/POST |
| Output format | JSON |
Only an administrator can call this endpoint. The accounts listed are the ones the administrator
can reach: an independent administrator reaches the accounts it created, and any other
administrator reaches every account. The Can interact with permission does not apply here.
Important
Before FileRun
2026.4.0, any account could call this endpoint, and itsCan interact withpermission applied. An API client that searches for the people to share with usesDrive/users/searchinstead.
Request parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
| search | string | Only for regular users, not for the superuser | Keyword to search in first name, last name or e-mail address |
The response
The results array holds at most 50 accounts, sorted by first name. Only person accounts are
listed: regular accounts and guest accounts. Internal accounts, such as the System account, are left
out. The account making the request is left out too, except for the superuser. Each entry has the
following fields:
| Field | Type | Description |
|---|---|---|
| first_name | string | |
| last_name | string | |
| string | ||
| full_name | string | |
| public_id | string | The public id, which the sharing endpoints take |
| id | integer | Included only for the superuser |
| username | string | Included only for the superuser |