List users associated with a given detection

GET

/detections/{detectionId}/users

Fetches a list of unique user email addresses involved in a given detection.
Returns distinct emails of people impacted by the detection based on the detection's
filters and security event type. For behavior-based detections, queries behaviors table;
for resource-based detections, queries resources table.

Request

Authorization

Bearer Token

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

Path Params

Responses

🟢200

application/json

Successful operation

Body

🟠401

🟠403

🟠404

Request Example

Shell

JavaScript

Java

Swift

curl --location --request GET '/detections//users' \
--header 'Authorization: Bearer <token>'

Response Example

{
    "users": [
        "alice@example.com",
        "bob@example.com"
    ]
}

Modified at 2026-01-07 08:56:31

List users associated with a given detection

Query all Shadow IT instances