Query Auth Users

List authorized users on the caller's account. Results are always scoped to the caller's account — Bearer tokens use the token's account; Basic (API key) callers use the application's configured operator account. Role assignments for OWNER are excluded.

Both filters are optional and narrow the results further by email and/or phone.

🔒 Restricted Access

This query requires the VIEW_SUBUSERS scope. It supports both Bearer (user access token) and Basic (<API_KEY>) authentication.

query AuthorizedUsers(
  $email: String
  $phone: String
) {
  authorizedUsers(
    email: $email
    phone: $phone
  ) {
    authUserId
    roles
    status
    email
    phone
    firstName
    lastName
  }
}

Parameters

Parameter	Type	Required	Description
email	String	No	Filter by the email address of the authorized user.
phone	String	No	Filter by the phone number of the authorized user.

Response

Success Response

{
  "data": {
    "authorizedUsers": [
      {
        "authUserId": "8b2c1e0a-7d4f-4a9b-9c2d-1f3e4a5b6c7d",
        "roles": ["MANAGER", "VIEWER"],
        "status": "ACTIVE",
        "email": "[email protected]",
        "phone": "+15555555555",
        "firstName": "Ada",
        "lastName": "Lovelace"
      }
    ]
  }
}

Response Fields

Field	Type	Description
`authUserId`	UUID	The authorized user ID (UAC role assignment ID). Pass this value to `removeAuthorizedUser`.
`roles`	[UACRoleType]	Roles assigned to the user on the account.
`status`	UACRoleStatusType	Status of the role assignment: `PENDING`, `ACTIVE`, `INACTIVE`, or `DECLINED`.
`email`	String	Email address of the authorized user.
`phone`	String	Phone number of the authorized user.
`firstName`	String	First name of the authorized user.
`lastName`	String	Last name of the authorized user.

Example Request

curl -X POST https://transactional-graph.staging.fluzapp.com/api/v1/graphql \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <your_access_token>" \
  -d '{
  "query": "query AuthorizedUsers($email: String, $phone: String) { authorizedUsers(email: $email, phone: $phone) { authUserId roles status email phone firstName lastName } }",
  "variables": {
    "email": "[email protected]"
  }
}'

const response = await fetch('https://transactional-graph.staging.fluzapp.com/api/v1/graphql', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Authorization': `Bearer ${accessToken}`
  },
  body: JSON.stringify({
    query: `
      query AuthorizedUsers(
        $email: String
        $phone: String
      ) {
        authorizedUsers(
          email: $email
          phone: $phone
        ) {
          authUserId
          roles
          status
          email
          phone
          firstName
          lastName
        }
      }
    `,
    variables: {
      email: "[email protected]"
    }
  })
});

const data = await response.json();
console.log('Authorized users:', data.data.authorizedUsers);

Error Codes

Code	Message	Description
`AUTH-0008`	Invalid user access	The caller could not be resolved from the access token or API key, or the Basic-auth application has no operator account configured. Verify your authentication credentials.
`AUTH-0031`	The requested scopes must be granted by the user first.	The token is missing the `VIEW_SUBUSERS` scope required to list authorized users.