> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scanova.io/llms.txt
> Use this file to discover all available pages before exploring further.

# List shared users

> GET /multi-users/

Shared users are the teammates you invite into your Scanova account — the same list shown on the dashboard's **Users** table. This endpoint lets you list, invite, update, or remove them programmatically.

<Note>
  This endpoint was not previously documented. It requires a Management API key with `MANAGEMENT_API` (or `MANAGEMENT_API_SANDBOX`) quota, sent as the raw `Authorization` header value — see the [Management API overview](/api-reference/management-api/overview) — plus the account's own Team quota for shared users. For what each role actually grants, see [Roles & permissions](/team/roles-and-permissions); for the wire format of roles themselves, see [Roles (access levels)](/api-reference/management-api/shared-users/roles-list).
</Note>

<RequestExample>
  ```bash cURL theme={null}
  curl --request GET \
    --url 'https://management.scanova.io/multi-users/' \
    --header 'Authorization: YOUR_API_KEY'
  ```
</RequestExample>

<ResponseExample>
  ```json 200 theme={null}
  {
    "count": 0,
    "next": null,
    "previous": null,
    "results": []
  }
  ```
</ResponseExample>

<Note>
  Verified live against a test account with no invited teammates yet — hence the empty `results`. The shape below (from the underlying serializer) is what each entry looks like once teammates exist.
</Note>

<ParamField query="email" type="string">
  Exact-match filter on the shared user's email address.
</ParamField>

<ParamField query="name" type="string">
  Case-insensitive substring match against the shared user's first name.
</ParamField>

<ParamField query="roles" type="string">
  Comma-separated role names to filter by, e.g. `Admin,Manager`.
</ParamField>

<ParamField query="status" type="string">
  One of `invitation_sent`, `active`, `inactive`.
</ParamField>

<ParamField query="mfa_status" type="string">
  One of `enabled`, `disabled`, `pending`.
</ParamField>

<ParamField query="ordering" type="string">
  `shared_user__email`, `shared_user__first_name`, or either prefixed with `-` for descending.
</ParamField>

### Response fields (per entry)

<ResponseField name="id" type="integer">
  Shared-user record ID — use this as `{pk}` for the retrieve/update/delete endpoints below.
</ResponseField>

<ResponseField name="shared_user" type="object">
  The invited user's account.

  <Expandable title="shared_user properties">
    <ResponseField name="id" type="integer">User ID.</ResponseField>

    <ResponseField name="first_name" type="string" />

    <ResponseField name="last_name" type="string" />

    <ResponseField name="full_name" type="string" />

    <ResponseField name="email" type="string" />

    <ResponseField name="is_active" type="boolean">False when deactivated by the owner.</ResponseField>
    <ResponseField name="is_locked" type="boolean">True if locked out under the account's password policy.</ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="access_level" type="object">
  The assigned role, in the same shape returned by [`GET /multi-users/access-levels/`](/api-reference/management-api/shared-users/roles-list).
</ResponseField>

<ResponseField name="status" type="string">
  Computed status: `Invitation Sent`, `Active`, `Inactive` (no login in 60+ days), or `Locked`.
</ResponseField>

<ResponseField name="is_active" type="boolean">
  Whether the shared user's account is active (distinct from `status` — a deactivated user always shows `is_active: false` regardless of invitation state).
</ResponseField>

<ResponseField name="invitation_sent_on" type="string | null">
  ISO 8601 timestamp of the (most recent) invitation email.
</ResponseField>

<ResponseField name="invitation_accepted_on" type="string | null">
  ISO 8601 timestamp of when the invite was accepted, or `null` if still pending.
</ResponseField>

<ResponseField name="enable_tag_permission" type="boolean">
  If true, this user's QR-code visibility is restricted to the tags in `tags` below.
</ResponseField>

<ResponseField name="include_untagged" type="boolean">
  When tag-based permission is enabled, whether the user can also see untagged QR codes.
</ResponseField>

<ResponseField name="tags" type="array">
  Tags this user is scoped to (only meaningful when `enable_tag_permission` is true), in `{id, name}` form.
</ResponseField>

<ResponseField name="created" type="string" />

<ResponseField name="modified" type="string" />

## Related

* [Invite a shared user](/api-reference/management-api/shared-users/invite) — the other operation on this same endpoint.
* [Retrieve a shared user](/api-reference/management-api/shared-users/retrieve) — operate on a single shared user returned by this list.
* [Update a shared user](/api-reference/management-api/shared-users/update) — operate on a single shared user returned by this list.
* [Remove a shared user](/api-reference/management-api/shared-users/remove) — operate on a single shared user returned by this list.
* [List roles](/api-reference/management-api/shared-users/roles-list) — look up or create the `access_level` ID this endpoint's invite/update calls require.
* [Create a custom role](/api-reference/management-api/shared-users/roles-create) — look up or create the `access_level` ID this endpoint's invite/update calls require.
* [Shared users](/team/shared-users) — the dashboard's own Users table, showing the same invite/deactivate/remove actions.
* [Roles & permissions](/team/roles-and-permissions) — what each role actually grants a teammate.


## OpenAPI

````yaml api-reference/openapi/management-api.json GET /multi-users/
openapi: 3.1.0
info:
  title: Scanova Management API (v2)
  description: >-
    The complete Scanova Management API — every endpoint available at
    management.scanova.io (QR codes, folders, tags, leads, forms, analytics,
    plans, shared users & roles), plus the token-creation and usage-stats
    endpoints used to authenticate against it. Every path and request/response
    shape below was verified live against a real API key and the actual running
    backend (Phase 7, 2026-08-16) — not guessed from reading urls.py alone.
  version: 2.0.0
servers:
  - url: https://management.scanova.io
    description: Management API — QR/folder/tag/lead/form/analytics/plans endpoints
security:
  - apiKeyAuth: []
paths:
  /multi-users/:
    get:
      summary: List shared users
      operationId: listManagedSharedUsers
      responses:
        '200':
          description: Paginated list of shared users invited to this account.
          content:
            application/json:
              example:
                count: 0
                next: null
                previous: null
                results: []
components:
  securitySchemes:
    apiKeyAuth:
      type: apiKey
      in: header
      name: Authorization
      description: >-
        Send your Management API key as the raw value of the Authorization
        header — no "Bearer " or "Token " prefix, and no other characters.
        Example: `Authorization: 401f7ac837da42b97f613d789819ff93537bee6a`. A
        header containing more than one space-separated part is rejected
        outright. Requests also require the request's Host header to be the
        management API host (e.g. management.scanova.io) — the same key sent to
        the regular API host will not authenticate.

````