API reference

The tenant this operation acts on. The caller must hold admin authority over it; every refusal — no authority, unknown, malformed — is the same 404

Opaque pagination cursor from a previous page's `cursors.next` or `cursors.prev`; paging direction travels inside the cursor. The sort is checked against the cursor, not taken from it — repeat the `orderBy` and `orderDirection` the first page used; a cursor cut on another column or in the other direction is refused with a 400 rather than silently restarting the list or walking the rows the wrong way

Items per page (default 20). A value above 100 is clamped to 100; a value that is not a whole number of at least 1 is refused with a 400

Column to sort by (default `id`). Any other value is refused with a 400 naming `orderBy` rather than silently sorted by `id`

Sort direction (default `asc`). Any other value is refused with a 400

Narrow the list to rows matching this text. Where the collection is full-text searched, every whitespace-separated word must begin a word of a searched field, in any case: `adm` finds `admin`, and `admin@exa` finds `admin@example.com`; only the first 16 words count. Users and organization members also match the start of an email's domain: `udibo` or `@udibo.com` finds `admin@udibo.com`, and a word starting with `@` matches the domain alone. Permissions, resource types, organization roles and webhook endpoints match the text anywhere in a searched field instead

Include soft-deleted rows when `true`

Only rows created strictly after this instant. A bare calendar date (`2026-03-17`) names a whole UTC day instead, and the window opens at that day's first instant.

Only rows created strictly before this instant. A bare calendar date (`2026-03-17`) names a whole UTC day instead, and the window runs through that day's last instant.

Only rows updated strictly after this instant. A bare calendar date (`2026-03-17`) names a whole UTC day instead, and the window opens at that day's first instant.

Only rows updated strictly before this instant. A bare calendar date (`2026-03-17`) names a whole UTC day instead, and the window runs through that day's last instant.