API / API reference / Instance
List all accounts
List all accounts
GET /api/v1/instance/accounts
Lists every account of the instance, including service accounts, with instance roles, second-factor state and last sign-in. q searches name and e-mail address. Requires the permission instance.accounts.view on the instance.
curl -H "Authorization: Bearer ld_..." \ "https://wiki.example.org/api/v1/instance/accounts?limit=20"Lists every account of the instance, including service accounts, with instance roles, second-factor state and last sign-in. q searches name and e-mail address.
Requires the permission instance.accounts.view on the instance.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Query Parameters
Section titled “Query Parameters”Opaque cursor from nextCursor of the previous page. Leave it out for the first page.
Maximum number of items in the page, from 1 to 200. Default 50.
Only items that contain this text, ignoring case: in the name and e-mail address of accounts and members, the name and short name of organizations, and the name and description of groups.
With true, only accounts without any current membership in an organization.
Only accounts in this lifecycle state.
Responses
Section titled “Responses”Accounts of the instance.
One page of results.
object
Accounts, ordered by name.
An account of the instance with what administrators need to see.
object
ID of the account.
Kind of account.
Lifecycle state of the account.
E-mail address, or null.
Display name.
When the account was created. ISO 8601 timestamp in UTC.
Whether the account has an authenticator app or a passkey.
Whether the instance or the home organization requires a second factor that the account does not have yet.
object
ID of the identity provider.
Name of the identity provider.
Kind of identity provider. New values can be added in later versions; handle unknown values.
Why the provider manages the account: identity when an identity of the provider is linked, domain when the e-mail domain of the account is assigned to the provider.
Since when the provider manages the account. ISO 8601 timestamp in UTC.
Current memberships of the account, the home organization first.
An organization the account is a member, collaborator or guest of.
object
ID of the organization.
Name of the organization.
Whether this is the home organization of the account.
Cursor for the next page, or null on the last page. Pass it as cursor.
Example
{ "items": [ { "id": "01929b1e-8d4b-7e3f-a05c-4d3e2f1a6b7c", "type": "standard", "state": "active", "name": "Ada Lovelace", "homeOrganizationId": "01929b1e-7c3a-7d2e-9f4b-3c2d1e0f5a6b", "createdAt": "2026-10-01T08:00:00.000Z", "lastSignInAt": "2026-10-01T09:30:00.000Z", "twoFactorActive": true, "secondFactorRequired": false, "managedBy": { "providerId": "01929b1f-1b7e-7b62-938f-7a6b5c4d9e0f", "providerName": "Company login", "providerType": "oidc", "source": "identity", "since": "2026-09-14T07:45:00.000Z" }, "instanceRoles": [ { "builtInRole": "securityAuditor", "customRoleId": null, "name": null } ], "organizations": [ { "id": "01929b1e-7c3a-7d2e-9f4b-3c2d1e0f5a6b", "name": "Example Inc.", "home": true } ] } ], "nextCursor": null}ambiguousCredentials: The request carries both a session and an API token. invalidInput: The request is not valid.
Error response following RFC 9457 Problem Details.
object
Stable identifier of the error kind. Clients branch on this value.
Short summary of the error kind. It does not change between occurrences.
HTTP status code of the response.
Explanation of this occurrence, for people.
The last part of type, for clients that prefer a short key.
Invalid fields, for invalidInput, invalidStorageSettings, invalidBackupSettings and the codes about the address of a chat channel.
Why the request was not allowed, for forbidden.
Seconds to wait before retrying, for rateLimited, locked and busy.
Which password rule failed, for passwordPolicy; why the address of a chat channel was refused, for invalidChatAddress; which storage setting was refused (invalidThresholds, invalidS3Limit, invalidContacts or invalidTeamsWebhook), for invalidStorageSettings; which backup setting was refused, for invalidBackupSettings; whether a backup or a testRestore is running, for backupRunning; why the backup target could not be used (a failure of Test connection, such as notFound or credentials, or missingSecret), for backupTargetFailed.
What Lunedo was doing with the backup target when it failed, for backupTargetFailed.
What the full storage refuses, for storageFull: an upload, or a large write such as an import.
Minimum password length, for passwordPolicy.
Level that locked the setting, for settingLocked.
Lowest allowed value, for settingBelowMinimum.
Maximum lifetime of API tokens in days, for expiryRequired and expiryTooLate.
Domains that belong to another identity provider, for domainInUse.
The current address of the instance, for instanceMoved.
ID of the identity provider that manages the account, for managedAccount and managedDomain.
Name of the identity provider that manages the account, for managedAccount and managedDomain.
Number of accounts still linked to the identity provider, for providerHasAccounts.
Largest allowed file size in bytes, for fileTooLarge and uploadTooLarge; storage limit of the organization’s imports, for organizationImportLimit.
Bytes the organization’s imports use already, for organizationImportLimit.
Number of parts still missing, for uploadIncomplete.
Number of pages below that your own role does not cover, for shareBeyondOwnAccess.
Longest allowed lifetime of a link for anyone in days, for expiryTooLate.
Number of pages that give access to groups or through broad links, for confidentialSharing; number of pages that would lose the status, for statusInUse; number of pages the caller cannot open, for hiddenContent.
Required sections that are empty or missing, for requiredSectionsEmpty.
A required section.
object
Key of the section.
Heading of the section.
Number of articles more people could read, for audienceWidening and categoryVisibilityWidening.
Number of translations into the language, for defaultLanguageTranslated.
The existing translation, for translationExists.
Check of the light mode color, for brandContrast.
object
The checked color.
Whether it reaches the contrast WCAG AA asks for.
Contrast of the color as text on the background.
Contrast of text on the color.
The nearest shade that passes, or null when none exists.
Check of the dark mode color, for brandContrast.
object
The checked color.
Whether it reaches the contrast WCAG AA asks for.
Contrast of the color as text on the background.
Contrast of text on the color.
The nearest shade that passes, or null when none exists.
Who gains and who loses access, with the confirmation to send, for moveChangesAccess.
object
Number of people who get access.
Number of people who lose access.
Number of people whose role rises.
Number of people whose role drops.
Number of affected people the caller may not see; they are counted but not listed.
Whether changes lists only the first 100 people.
People whose access changes, ordered by name.
How the access of one person changes.
object
ID of the account.
Name of the person.
True when the content leaves a confidential space and loses its protection.
Send this with the move to confirm exactly this change, or null when access does not change. Valid for one hour.
Who could read the copy but not the source, with the confirmation to send, for copyChangesAccess.
object
Number of people who get access.
Number of people who lose access.
Number of people whose role rises.
Number of people whose role drops.
Number of affected people the caller may not see; they are counted but not listed.
Whether changes lists only the first 100 people.
People whose access changes, ordered by name.
How the access of one person changes.
object
ID of the account.
Name of the person.
True when the copy leaves a confidential space and is not protected by it.
True when people can read the copy who cannot read the source; the copy then needs the confirmation.
Send this with the copy to confirm exactly this access, or null when nobody gains access. Valid for one hour.
Number of items the copy creates.
Number of items below that are left out because the caller cannot read them.
Number of items below that are left out because they cannot be copied.
True when the copy is large and runs in the background.
Number of trash entries of former parent pages the caller can restore together with the content, for restrictedParentInTrash; 0 when the caller cannot restore all of them.
Format or editor schema version of the file, for newerTemplateFormat.
Highest format or editor schema version this Lunedo reads, for newerTemplateFormat.
Position of the template in the file, counted from 0, for templateNameTaken.
What is wrong with the templates of the file, for invalidTemplatesInFile.
A problem in a template of the file.
object
Where in the template, such as field 3 or content.
Explanation for people, naming the template and the place.
The message of the instance administrators about the maintenance, for maintenanceMode and signInPaused. Empty when they wrote none.
What is wrong with the document, for invalidDocument and invalidComment.
A problem in the document.
object
Position in the document, such as .content[2].content[0].
Kind of problem, such as unknownNode or invalidAttribute.
Explanation for people.
Examples
{ "type": "urn:lunedo:problem:ambiguousCredentials", "title": "The request carries both a session and an API token", "status": 400, "code": "ambiguousCredentials"}{ "type": "urn:lunedo:problem:invalidInput", "title": "The request is not valid", "status": 400, "code": "invalidInput"}invalidApiToken: The API token is not valid. notSignedIn: Sign in or send an API token.
Error response following RFC 9457 Problem Details.
object
Stable identifier of the error kind. Clients branch on this value.
Short summary of the error kind. It does not change between occurrences.
HTTP status code of the response.
Explanation of this occurrence, for people.
The last part of type, for clients that prefer a short key.
Invalid fields, for invalidInput, invalidStorageSettings, invalidBackupSettings and the codes about the address of a chat channel.
Why the request was not allowed, for forbidden.
Seconds to wait before retrying, for rateLimited, locked and busy.
Which password rule failed, for passwordPolicy; why the address of a chat channel was refused, for invalidChatAddress; which storage setting was refused (invalidThresholds, invalidS3Limit, invalidContacts or invalidTeamsWebhook), for invalidStorageSettings; which backup setting was refused, for invalidBackupSettings; whether a backup or a testRestore is running, for backupRunning; why the backup target could not be used (a failure of Test connection, such as notFound or credentials, or missingSecret), for backupTargetFailed.
What Lunedo was doing with the backup target when it failed, for backupTargetFailed.
What the full storage refuses, for storageFull: an upload, or a large write such as an import.
Minimum password length, for passwordPolicy.
Level that locked the setting, for settingLocked.
Lowest allowed value, for settingBelowMinimum.
Maximum lifetime of API tokens in days, for expiryRequired and expiryTooLate.
Domains that belong to another identity provider, for domainInUse.
The current address of the instance, for instanceMoved.
ID of the identity provider that manages the account, for managedAccount and managedDomain.
Name of the identity provider that manages the account, for managedAccount and managedDomain.
Number of accounts still linked to the identity provider, for providerHasAccounts.
Largest allowed file size in bytes, for fileTooLarge and uploadTooLarge; storage limit of the organization’s imports, for organizationImportLimit.
Bytes the organization’s imports use already, for organizationImportLimit.
Number of parts still missing, for uploadIncomplete.
Number of pages below that your own role does not cover, for shareBeyondOwnAccess.
Longest allowed lifetime of a link for anyone in days, for expiryTooLate.
Number of pages that give access to groups or through broad links, for confidentialSharing; number of pages that would lose the status, for statusInUse; number of pages the caller cannot open, for hiddenContent.
Required sections that are empty or missing, for requiredSectionsEmpty.
A required section.
object
Key of the section.
Heading of the section.
Number of articles more people could read, for audienceWidening and categoryVisibilityWidening.
Number of translations into the language, for defaultLanguageTranslated.
The existing translation, for translationExists.
Check of the light mode color, for brandContrast.
object
The checked color.
Whether it reaches the contrast WCAG AA asks for.
Contrast of the color as text on the background.
Contrast of text on the color.
The nearest shade that passes, or null when none exists.
Check of the dark mode color, for brandContrast.
object
The checked color.
Whether it reaches the contrast WCAG AA asks for.
Contrast of the color as text on the background.
Contrast of text on the color.
The nearest shade that passes, or null when none exists.
Who gains and who loses access, with the confirmation to send, for moveChangesAccess.
object
Number of people who get access.
Number of people who lose access.
Number of people whose role rises.
Number of people whose role drops.
Number of affected people the caller may not see; they are counted but not listed.
Whether changes lists only the first 100 people.
People whose access changes, ordered by name.
How the access of one person changes.
object
ID of the account.
Name of the person.
True when the content leaves a confidential space and loses its protection.
Send this with the move to confirm exactly this change, or null when access does not change. Valid for one hour.
Who could read the copy but not the source, with the confirmation to send, for copyChangesAccess.
object
Number of people who get access.
Number of people who lose access.
Number of people whose role rises.
Number of people whose role drops.
Number of affected people the caller may not see; they are counted but not listed.
Whether changes lists only the first 100 people.
People whose access changes, ordered by name.
How the access of one person changes.
object
ID of the account.
Name of the person.
True when the copy leaves a confidential space and is not protected by it.
True when people can read the copy who cannot read the source; the copy then needs the confirmation.
Send this with the copy to confirm exactly this access, or null when nobody gains access. Valid for one hour.
Number of items the copy creates.
Number of items below that are left out because the caller cannot read them.
Number of items below that are left out because they cannot be copied.
True when the copy is large and runs in the background.
Number of trash entries of former parent pages the caller can restore together with the content, for restrictedParentInTrash; 0 when the caller cannot restore all of them.
Format or editor schema version of the file, for newerTemplateFormat.
Highest format or editor schema version this Lunedo reads, for newerTemplateFormat.
Position of the template in the file, counted from 0, for templateNameTaken.
What is wrong with the templates of the file, for invalidTemplatesInFile.
A problem in a template of the file.
object
Where in the template, such as field 3 or content.
Explanation for people, naming the template and the place.
The message of the instance administrators about the maintenance, for maintenanceMode and signInPaused. Empty when they wrote none.
What is wrong with the document, for invalidDocument and invalidComment.
A problem in the document.
object
Position in the document, such as .content[2].content[0].
Kind of problem, such as unknownNode or invalidAttribute.
Explanation for people.
Examples
{ "type": "urn:lunedo:problem:invalidApiToken", "title": "The API token is not valid", "status": 401, "code": "invalidApiToken"}{ "type": "urn:lunedo:problem:notSignedIn", "title": "Sign in or send an API token", "status": 401, "code": "notSignedIn"}forbidden: Not allowed.
Error response following RFC 9457 Problem Details.
object
Stable identifier of the error kind. Clients branch on this value.
Short summary of the error kind. It does not change between occurrences.
HTTP status code of the response.
Explanation of this occurrence, for people.
The last part of type, for clients that prefer a short key.
Invalid fields, for invalidInput, invalidStorageSettings, invalidBackupSettings and the codes about the address of a chat channel.
Why the request was not allowed, for forbidden.
Seconds to wait before retrying, for rateLimited, locked and busy.
Which password rule failed, for passwordPolicy; why the address of a chat channel was refused, for invalidChatAddress; which storage setting was refused (invalidThresholds, invalidS3Limit, invalidContacts or invalidTeamsWebhook), for invalidStorageSettings; which backup setting was refused, for invalidBackupSettings; whether a backup or a testRestore is running, for backupRunning; why the backup target could not be used (a failure of Test connection, such as notFound or credentials, or missingSecret), for backupTargetFailed.
What Lunedo was doing with the backup target when it failed, for backupTargetFailed.
What the full storage refuses, for storageFull: an upload, or a large write such as an import.
Minimum password length, for passwordPolicy.
Level that locked the setting, for settingLocked.
Lowest allowed value, for settingBelowMinimum.
Maximum lifetime of API tokens in days, for expiryRequired and expiryTooLate.
Domains that belong to another identity provider, for domainInUse.
The current address of the instance, for instanceMoved.
ID of the identity provider that manages the account, for managedAccount and managedDomain.
Name of the identity provider that manages the account, for managedAccount and managedDomain.
Number of accounts still linked to the identity provider, for providerHasAccounts.
Largest allowed file size in bytes, for fileTooLarge and uploadTooLarge; storage limit of the organization’s imports, for organizationImportLimit.
Bytes the organization’s imports use already, for organizationImportLimit.
Number of parts still missing, for uploadIncomplete.
Number of pages below that your own role does not cover, for shareBeyondOwnAccess.
Longest allowed lifetime of a link for anyone in days, for expiryTooLate.
Number of pages that give access to groups or through broad links, for confidentialSharing; number of pages that would lose the status, for statusInUse; number of pages the caller cannot open, for hiddenContent.
Required sections that are empty or missing, for requiredSectionsEmpty.
A required section.
object
Key of the section.
Heading of the section.
Number of articles more people could read, for audienceWidening and categoryVisibilityWidening.
Number of translations into the language, for defaultLanguageTranslated.
The existing translation, for translationExists.
Check of the light mode color, for brandContrast.
object
The checked color.
Whether it reaches the contrast WCAG AA asks for.
Contrast of the color as text on the background.
Contrast of text on the color.
The nearest shade that passes, or null when none exists.
Check of the dark mode color, for brandContrast.
object
The checked color.
Whether it reaches the contrast WCAG AA asks for.
Contrast of the color as text on the background.
Contrast of text on the color.
The nearest shade that passes, or null when none exists.
Who gains and who loses access, with the confirmation to send, for moveChangesAccess.
object
Number of people who get access.
Number of people who lose access.
Number of people whose role rises.
Number of people whose role drops.
Number of affected people the caller may not see; they are counted but not listed.
Whether changes lists only the first 100 people.
People whose access changes, ordered by name.
How the access of one person changes.
object
ID of the account.
Name of the person.
True when the content leaves a confidential space and loses its protection.
Send this with the move to confirm exactly this change, or null when access does not change. Valid for one hour.
Who could read the copy but not the source, with the confirmation to send, for copyChangesAccess.
object
Number of people who get access.
Number of people who lose access.
Number of people whose role rises.
Number of people whose role drops.
Number of affected people the caller may not see; they are counted but not listed.
Whether changes lists only the first 100 people.
People whose access changes, ordered by name.
How the access of one person changes.
object
ID of the account.
Name of the person.
True when the copy leaves a confidential space and is not protected by it.
True when people can read the copy who cannot read the source; the copy then needs the confirmation.
Send this with the copy to confirm exactly this access, or null when nobody gains access. Valid for one hour.
Number of items the copy creates.
Number of items below that are left out because the caller cannot read them.
Number of items below that are left out because they cannot be copied.
True when the copy is large and runs in the background.
Number of trash entries of former parent pages the caller can restore together with the content, for restrictedParentInTrash; 0 when the caller cannot restore all of them.
Format or editor schema version of the file, for newerTemplateFormat.
Highest format or editor schema version this Lunedo reads, for newerTemplateFormat.
Position of the template in the file, counted from 0, for templateNameTaken.
What is wrong with the templates of the file, for invalidTemplatesInFile.
A problem in a template of the file.
object
Where in the template, such as field 3 or content.
Explanation for people, naming the template and the place.
The message of the instance administrators about the maintenance, for maintenanceMode and signInPaused. Empty when they wrote none.
What is wrong with the document, for invalidDocument and invalidComment.
A problem in the document.
object
Position in the document, such as .content[2].content[0].
Kind of problem, such as unknownNode or invalidAttribute.
Explanation for people.
Examples
{ "type": "urn:lunedo:problem:forbidden", "title": "Not allowed", "status": 403, "code": "forbidden"}rateLimited: Too many requests.
Error response following RFC 9457 Problem Details.
object
Stable identifier of the error kind. Clients branch on this value.
Short summary of the error kind. It does not change between occurrences.
HTTP status code of the response.
Explanation of this occurrence, for people.
The last part of type, for clients that prefer a short key.
Invalid fields, for invalidInput, invalidStorageSettings, invalidBackupSettings and the codes about the address of a chat channel.
Why the request was not allowed, for forbidden.
Seconds to wait before retrying, for rateLimited, locked and busy.
Which password rule failed, for passwordPolicy; why the address of a chat channel was refused, for invalidChatAddress; which storage setting was refused (invalidThresholds, invalidS3Limit, invalidContacts or invalidTeamsWebhook), for invalidStorageSettings; which backup setting was refused, for invalidBackupSettings; whether a backup or a testRestore is running, for backupRunning; why the backup target could not be used (a failure of Test connection, such as notFound or credentials, or missingSecret), for backupTargetFailed.
What Lunedo was doing with the backup target when it failed, for backupTargetFailed.
What the full storage refuses, for storageFull: an upload, or a large write such as an import.
Minimum password length, for passwordPolicy.
Level that locked the setting, for settingLocked.
Lowest allowed value, for settingBelowMinimum.
Maximum lifetime of API tokens in days, for expiryRequired and expiryTooLate.
Domains that belong to another identity provider, for domainInUse.
The current address of the instance, for instanceMoved.
ID of the identity provider that manages the account, for managedAccount and managedDomain.
Name of the identity provider that manages the account, for managedAccount and managedDomain.
Number of accounts still linked to the identity provider, for providerHasAccounts.
Largest allowed file size in bytes, for fileTooLarge and uploadTooLarge; storage limit of the organization’s imports, for organizationImportLimit.
Bytes the organization’s imports use already, for organizationImportLimit.
Number of parts still missing, for uploadIncomplete.
Number of pages below that your own role does not cover, for shareBeyondOwnAccess.
Longest allowed lifetime of a link for anyone in days, for expiryTooLate.
Number of pages that give access to groups or through broad links, for confidentialSharing; number of pages that would lose the status, for statusInUse; number of pages the caller cannot open, for hiddenContent.
Required sections that are empty or missing, for requiredSectionsEmpty.
A required section.
object
Key of the section.
Heading of the section.
Number of articles more people could read, for audienceWidening and categoryVisibilityWidening.
Number of translations into the language, for defaultLanguageTranslated.
The existing translation, for translationExists.
Check of the light mode color, for brandContrast.
object
The checked color.
Whether it reaches the contrast WCAG AA asks for.
Contrast of the color as text on the background.
Contrast of text on the color.
The nearest shade that passes, or null when none exists.
Check of the dark mode color, for brandContrast.
object
The checked color.
Whether it reaches the contrast WCAG AA asks for.
Contrast of the color as text on the background.
Contrast of text on the color.
The nearest shade that passes, or null when none exists.
Who gains and who loses access, with the confirmation to send, for moveChangesAccess.
object
Number of people who get access.
Number of people who lose access.
Number of people whose role rises.
Number of people whose role drops.
Number of affected people the caller may not see; they are counted but not listed.
Whether changes lists only the first 100 people.
People whose access changes, ordered by name.
How the access of one person changes.
object
ID of the account.
Name of the person.
True when the content leaves a confidential space and loses its protection.
Send this with the move to confirm exactly this change, or null when access does not change. Valid for one hour.
Who could read the copy but not the source, with the confirmation to send, for copyChangesAccess.
object
Number of people who get access.
Number of people who lose access.
Number of people whose role rises.
Number of people whose role drops.
Number of affected people the caller may not see; they are counted but not listed.
Whether changes lists only the first 100 people.
People whose access changes, ordered by name.
How the access of one person changes.
object
ID of the account.
Name of the person.
True when the copy leaves a confidential space and is not protected by it.
True when people can read the copy who cannot read the source; the copy then needs the confirmation.
Send this with the copy to confirm exactly this access, or null when nobody gains access. Valid for one hour.
Number of items the copy creates.
Number of items below that are left out because the caller cannot read them.
Number of items below that are left out because they cannot be copied.
True when the copy is large and runs in the background.
Number of trash entries of former parent pages the caller can restore together with the content, for restrictedParentInTrash; 0 when the caller cannot restore all of them.
Format or editor schema version of the file, for newerTemplateFormat.
Highest format or editor schema version this Lunedo reads, for newerTemplateFormat.
Position of the template in the file, counted from 0, for templateNameTaken.
What is wrong with the templates of the file, for invalidTemplatesInFile.
A problem in a template of the file.
object
Where in the template, such as field 3 or content.
Explanation for people, naming the template and the place.
The message of the instance administrators about the maintenance, for maintenanceMode and signInPaused. Empty when they wrote none.
What is wrong with the document, for invalidDocument and invalidComment.
A problem in the document.
object
Position in the document, such as .content[2].content[0].
Kind of problem, such as unknownNode or invalidAttribute.
Explanation for people.
Examples
{ "type": "urn:lunedo:problem:rateLimited", "title": "Too many requests", "status": 429, "code": "rateLimited"}