# List LMS users correlated with sessions

**GET /v1/users**



## Servers
- https://api.isnotai.com (Production (US))
- https://api-eu.isnotai.com (Production (EU))

API keys are region-bound: a key authenticates only against the base URL of the region it was minted in. The other region returns 401 INVALID_API_KEY.

## Authentication methods
- bearer_auth
- api_key

Send the API key as `Authorization: Bearer aik_v1_...` (preferred) or in the `x-api-key` header. Per-key rate-limit isolation applies only to the Bearer form. See [Authentication](https://www.isnotai.com/developers/authentication.md).

## Query parameters

- **pageSize** (integer(int32))
  Page size. The maximum is scoped to the integration's plan tier (Free 50, Pro and Enterprise 100). Requests above the tier maximum clamp to the maximum and the effective value is returned in pagination.limit. Minimum 1. Default 50.
- **cursor** (string)
  Opaque continuation cursor returned by a previous call.
- **search** (string)
  Case-insensitive substring match against userId or userName.


## Responses
### 200
Payload of UserListResponse

Response body (application/json):
- **data** (array[object])
  Array items:
  - **userId** (string)
  - **userName** (string)
  - **sessionCount** (integer(int32))
  - **botSessionCount** (integer(int32))
  - **mediumSessionCount** (integer(int32))
  - **averageBotScore** (number(double))
  - **maxBotScore** (number(double))
  - **deviceCount** (integer(int32))
  - **firstSeen** (string(date-time))
  - **lastSeen** (string(date-time))
  - **riskLevel** (string)
  - **sparkline** (array[integer(int32)])
  - **userUrl** (string)
- **pagination** (object)
  - **nextCursor** (string)
  - **hasMore** (boolean)
  - **limit** (integer(int32))

### 401
Payload of ErrorEnvelope

Response body (application/json):
- **error** (object)
  - **code** (string) *Required*
  - **message** (string) *Required*
  - **details** (object) *Required*
    Always present and null unless the error carries field-level context (validation errors set details.field to the offending parameter name).

Any authenticated route can also return 401 (missing or invalid key), 429 RATE_LIMITED (edge rate limit; Retry-After is an integer number of seconds), and 5xx errors, even where not listed above. See [Error Handling](https://www.isnotai.com/developers/error-handling.md) and [Rate Limits](https://www.isnotai.com/developers/rate-limits.md).