1. Company
Anzenna Public API
  • How To Use the Anzenna Public API
  • AI Governance
    • Query all Shadow AI instances
      POST
    • Get a Shadow AI instance by id
      GET
    • Query all AI interactions
      POST
    • Get an AI interaction by id
      GET
    • List MCP servers
      POST
    • Get an MCP server
      GET
    • Query MCP server installations
      POST
  • Investigation
    • Query all investigations
      POST
    • Start an investigation
      POST
    • Get an investigation by id
      GET
    • Dismiss an investigation
      POST
    • Get detection investigation prompts
      GET
    • Get global investigation prompts
      GET
    • Get user investigation prompts
      GET
    • Query all risk registers
      POST
    • Query all risk register catalog entries
      POST
  • Identity
    • List accounts
      POST
    • Get an account by id
      GET
    • List login events
      POST
    • Get a login event by ID
      GET
    • Query all mfa statuses
      POST
    • Get an MFA status by id
      GET
    • Query all OAuth applications
      POST
    • Get an OAuth application by id
      GET
    • Query all OAuth application instances
      POST
    • Query all password reuse instances
      POST
  • Advanced
    • Execute an advanced query
    • List security events
    • Receive a webhook event
    • Query raw events
  • Detection
    • Query all allowlists
    • Create a new allowlist
    • Delete an allowlist
    • Update an allowlist
    • Get an anomaly by ID
    • Get key finding detections
    • Get detection details
    • List users associated with a given detection
    • Execute a remediation
  • Browser
    • Query all browser applications
    • Get a browser application by id
    • List browser application instances
    • List browser history entries
    • Query all remote machines
    • Get a remote machine by id
    • Query all web host resources
    • Get a web host resource by id
  • Data & IP
    • Query database exfiltration events
    • List file delete events
    • List file movement activities
    • Get file movement activity by id
    • List files used with data exfiltration.
    • Get a specific data exfiltration file
    • List git events
    • Get a specific git event by id
    • List git repositories
    • Get a specific git repository
    • List file sharing instances
    • Query database share grants
    • Query database share user additions
    • List documents
    • Get document by id
    • List DLP policies
    • Get a DLP policy by id
    • List DLP policy detectors
    • Query all DLP alerts
    • Get a DLP alert by id
  • Device
    • List devices
    • Get a device
    • List device applications
    • Get a device application
    • Query device application instances.
    • List device infections
    • Get a device infection
    • List device policies
    • Get a device policy
    • List USB device connection events
    • Get a USB connection event
    • List IDE applications
    • Get an IDE application
    • Query IDE application instances.
  • Email
    • Query all outbound email events
    • Get an outbound email event by id
    • Query all phishing interactions
  • Company
    • List groups
      POST
    • Query all people
      POST
    • Get departure analysis for a person
      GET
    • Get a person by id
      GET
    • Add a category to multiple people
      POST
    • Remove a category from multiple people
      POST
    • Get company risk trends
      POST
    • Get number of high risk organizations
      POST
  • SaaS
    • Query all Shadow IT instances
  • Outreach
    • List training campaigns
    • Create a training campaign
  • API Key
    • Get API key information
  1. Company

Query all people

POST
/people
Query and filter people.
This endpoint only lists active users from the configured identity source.
To list all accounts known to Anzenna, including inactive users and users from
other data sources, use the "List Accounts" endpoint.
However, "Query All People" provides richer information about each user, such as
risk scores and other derived attributes.
Relations:
manager (Person): The person's manager
devices (Device): The person's devices. Warning - this is a one to many relation. This is not generally useful to find a user's devices because of the one to many joins resulting in duplicates, but it can be used to find a user without any devices (through devices.id IS NULL). It is not recommended to use it in any other fashion
Additional Filters:
category_label (string): Filter by custom category label text

Request

Authorization
Bearer Token
Provide your bearer token in the
Authorization
header when making requests to protected resources.
Example:
Authorization: Bearer ********************
or
Body Params application/jsonRequired

Examples

Responses

🟢200OK
application/json
Successful operation
Bodyapplication/json

🟠400Bad Request
🟠401Unauthorized
🟠403Forbidden
Request Request Example
Shell
JavaScript
Java
Swift
curl --location '/people' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{
    "distinct_count": "string",
    "distinct_on": "host_name",
    "include_total_count": true,
    "limit": 10,
    "offset": 0,
    "query": "name='\''WINPC-4291'\'' AND status IN ('\''active'\'', '\''pending'\'')",
    "sort": "name desc, id"
}'
Response Response Example
200 - Example 1
{
    "distinct_values": [
        {
            "count": 0,
            "value": null
        }
    ],
    "pagination": {
        "count": 0,
        "total_count": 1000
    },
    "items": [
        {
            "categories": [
                "automation"
            ],
            "departed_time": "2021-01-01T00:00:00Z",
            "department": "EPD",
            "email": "joe.smith@example.com",
            "id": "8CA67511-744C-4D74-B26E-7281CF88712F",
            "job_category": "engineer",
            "job_title": "Engineer",
            "last_login": "2021-01-01T00:00:00Z",
            "location_city": "San Francisco",
            "location_country": "USA",
            "location_state": "CA",
            "manager_email": "john.lopez@example.com",
            "manager_name": "John Lopez",
            "name": "Joe Smith",
            "password_changed": "2021-01-01T00:00:00Z",
            "risk_factors": [
                {
                    "magnitude": 40,
                    "type": "sensitive_file"
                }
            ],
            "risk_score": 9.2,
            "state": "unspecified"
        }
    ]
}
Modified at 2026-10-20 18:32:30
Previous
List groups
Next
Get departure analysis for a person
Built with