↑↓ to navigate ↵ to open Esc to close Search by Algolia

API: Search user accounts

Two endpoints turn a typed name or e-mail address into a user account. Drive/users/search finds the people an account can share with, and any account can call it. Core/users/search is for the administrators, and finds the accounts an administrator can manage. Both take the same parameter and answer in the same form.

Searching the people to share with

Target URL /api.php/Drive/users/search
Required scope share
HTTP Method GET/POST
Output format JSON

The accounts listed are the ones the account making the request can reach, narrowed by its Can interact with permission:

  • An account created by an independent administrator reaches the other accounts of that administrator, and the administrator itself. An independent administrator reaches the accounts it created. Any other account reaches every account.
  • The Can interact with permission narrows this to the users and the groups it names. An account it names outside the reach of the account making the request is not listed. When it names nobody, the answer is an empty list.

The request is refused when the account is not allowed to interact with other users.

This endpoint was added in FileRun 2026.4.0.

Searching the accounts as an administrator

Target URL /api.php/Core/users/search
Required scope admin
HTTP Method GET/POST
Output format JSON

Only an administrator can call this endpoint. The accounts listed are the ones the administrator can reach: an independent administrator reaches the accounts it created, and any other administrator reaches every account. The Can interact with permission does not apply here.

Important

Before FileRun 2026.4.0, any account could call this endpoint, and its Can interact with permission applied. An API client that searches for the people to share with uses Drive/users/search instead.

Request parameters

Parameter Type Required Description
search string Only for regular users, not for the superuser Keyword to search in first name, last name or e-mail address

The response

The results array holds at most 50 accounts, sorted by first name. Only person accounts are listed: regular accounts and guest accounts. Internal accounts, such as the System account, are left out. The account making the request is left out too, except for the superuser. Each entry has the following fields:

Field Type Description
first_name string
last_name string
email string
full_name string
public_id string The public id, which the sharing endpoints take
id integer Included only for the superuser
username string Included only for the superuser