Return All Database Users from One Project

GET /api/atlas/v2/groups/{groupId}/databaseUsers

Returns all database users that belong to the specified project. To use this resource, the requesting API Key must have the Project Read Only role.

Path parameters

  • groupId string Required

    Unique 24-hexadecimal digit string that identifies your project. Use the /groups endpoint to retrieve all projects to which the authenticated user has access.

    NOTE: Groups and projects are synonymous terms. Your group id is the same as your project id. For existing groups, your group/project id remains the same. The resource and corresponding endpoints use the term groups.

    Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.

Query parameters

  • envelope boolean

    Flag that indicates whether Application wraps the response in an envelope JSON object. Some API clients cannot access the HTTP response headers or status code. To remediate this, set envelope=true in the query. Endpoints that return a list of results use the results object as an envelope. Application adds the status parameter to the response body.

    Default value is false.

  • includeCount boolean

    Flag that indicates whether the response returns the total number of items (totalCount) in the response.

    Default value is true.

  • itemsPerPage integer

    Number of items that the response returns per page.

    Minimum value is 1, maximum value is 500. Default value is 100.

  • pageNum integer

    Number of the page that displays the current set of the total objects that the response returns.

    Minimum value is 1. Default value is 1.

  • pretty boolean

    Flag that indicates whether the response body should be in the prettyprint format.

    Default value is false.

Responses

  • 200 application/vnd.atlas.2023-01-01+json

    OK

    Hide response attributes Show response attributes object
    • results array[object]

      List of returned documents that MongoDB Cloud providers when completing this request.

      Hide results attributes Show results attributes object
      • awsIAMType string

        Human-readable label that indicates whether the new database user authenticates with the Amazon Web Services (AWS) Identity and Access Management (IAM) credentials associated with the user or the user's role.

        Values are NONE, USER, or ROLE. Default value is NONE.

      • databaseName string Required

        The database against which the database user authenticates. Database users must provide both a username and authentication database to log into MongoDB. If the user authenticates with AWS IAM, x.509, LDAP, or OIDC Workload this value should be $external. If the user authenticates with SCRAM-SHA or OIDC Workforce, this value should be admin.

        Values are admin or $external. Default value is admin.

      • deleteAfterDate string(date-time)

        Date and time when MongoDB Cloud deletes the user. This parameter expresses its value in the ISO 8601 timestamp format in UTC and can include the time zone designation. You must specify a future date that falls within one week of making the Application Programming Interface (API) request.

      • labels array[object]

        List that contains the key-value pairs for tagging and categorizing the MongoDB database user. The labels that you define do not appear in the console.

        Human-readable labels applied to this MongoDB Cloud component.

        Hide labels attributes Show labels attributes object
        • key string

          Key applied to tag and categorize this component.

          Minimum length is 1, maximum length is 255.

        • value string

          Value set to the Key applied to tag and categorize this component.

          Minimum length is 1, maximum length is 255.

      • ldapAuthType string

        Part of the Lightweight Directory Access Protocol (LDAP) record that the database uses to authenticate this database user on the LDAP host.

        Values are NONE, GROUP, or USER. Default value is NONE.

      • oidcAuthType string

        Human-readable label that indicates whether the new database user or group authenticates with OIDC federated authentication. To create a federated authentication user, specify the value of USER in this field. To create a federated authentication group, specify the value of IDP_GROUP in this field.

        Values are NONE, IDP_GROUP, or USER. Default value is NONE.

      • roles array[object]

        List that provides the pairings of one role with one applicable database.

        Range of resources available to this database user.

        Hide roles attributes Show roles attributes object
        • collectionName string

          Collection on which this role applies.

        • databaseName string Required

          Database to which the user is granted access privileges.

        • roleName string Required

          Human-readable label that identifies a group of privileges assigned to a database user. This value can either be a built-in role or a custom role.

          Values are atlasAdmin, backup, clusterMonitor, dbAdmin, dbAdminAnyDatabase, enableSharding, read, readAnyDatabase, readWrite, readWriteAnyDatabase, or <a custom role name>.

      • scopes array[object]

        List that contains clusters, MongoDB Atlas Data Lakes, and MongoDB Atlas Streams Instances that this database user can access. If omitted, MongoDB Cloud grants the database user access to all the clusters, MongoDB Atlas Data Lakes, and MongoDB Atlas Streams Instances in the project.

        Range of resources available to this database user.

        Hide scopes attributes Show scopes attributes object
        • name string Required

          Human-readable label that identifies the cluster or MongoDB Atlas Data Lake that this database user can access.

          Minimum length is 1, maximum length is 64. Format should match the following pattern: ^[a-zA-Z0-9][a-zA-Z0-9-]*$.

        • type string Required

          Category of resource that this database user can access.

          Values are CLUSTER, DATA_LAKE, or STREAM.

      • username string Required

        Human-readable label that represents the user that authenticates to MongoDB. The format of this label depends on the method of authentication:

        Authentication Method Parameter Needed Parameter Value username Format
        AWS IAM awsIAMType ROLE ARN
        AWS IAM awsIAMType USER ARN
        x.509 x509Type CUSTOMER RFC 2253 Distinguished Name
        x.509 x509Type MANAGED RFC 2253 Distinguished Name
        LDAP ldapAuthType USER RFC 2253 Distinguished Name
        LDAP ldapAuthType GROUP RFC 2253 Distinguished Name
        OIDC Workforce oidcAuthType IDP_GROUP Atlas OIDC IdP ID (found in federation settings), followed by a '/', followed by the IdP group name
        OIDC Workload oidcAuthType USER Atlas OIDC IdP ID (found in federation settings), followed by a '/', followed by the IdP user name
        SCRAM-SHA awsIAMType, x509Type, ldapAuthType, oidcAuthType NONE Alphanumeric string

        Maximum length is 1024.

      • x509Type string

        X.509 method that MongoDB Cloud uses to authenticate the database user.

        • For application-managed X.509, specify MANAGED.
        • For self-managed X.509, specify CUSTOMER.

        Users created with the CUSTOMER method require a Common Name (CN) in the username parameter. You must create externally authenticated users on the $external database.

        Values are NONE, CUSTOMER, or MANAGED. Default value is NONE.

    • totalCount integer(int32)

      Total number of documents available. MongoDB Cloud omits this value if includeCount is set to false.

      Minimum value is 0.

  • 401 application/json

    Unauthorized.

    Hide response attributes Show response attributes object
    • detail string

      Describes the specific conditions or reasons that cause each type of error.

    • error integer(int32)

      HTTP status code returned with this error.

      External documentation
    • errorCode string

      Application error code returned with this error.

    • parameters array[object]

      Parameters used to give more information about the error.

    • reason string

      Application error message returned with this error.

  • 500 application/json

    Internal Server Error.

    Hide response attributes Show response attributes object
    • detail string

      Describes the specific conditions or reasons that cause each type of error.

    • error integer(int32)

      HTTP status code returned with this error.

      External documentation
    • errorCode string

      Application error code returned with this error.

    • parameters array[object]

      Parameters used to give more information about the error.

    • reason string

      Application error message returned with this error.

GET /api/atlas/v2/groups/{groupId}/databaseUsers
atlas api databaseUsers listDatabaseUsers --help
import (
	"os"
	"context"
	"log"
	sdk "go.mongodb.org/atlas-sdk/v20230101001/admin"
)

func main() {
	ctx := context.Background()
	clientID := os.Getenv("MONGODB_ATLAS_CLIENT_ID")
	clientSecret := os.Getenv("MONGODB_ATLAS_CLIENT_SECRET")

	// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth
	client, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))

	if err != nil {
		log.Fatalf("Error: %v", err)
	}

	params = &sdk.ListDatabaseUsersApiParams{}
	sdkResp, httpResp, err := client.DatabaseUsersApi.
		ListDatabaseUsersWithParams(ctx, params).
		Execute()
}
curl --include --header "Authorization: Bearer ${ACCESS_TOKEN}" \
  --header "Accept: application/vnd.atlas.2023-01-01+json" \
  -X GET "https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers?pretty=true"
curl --user "${PUBLIC_KEY}:${PRIVATE_KEY}" \
  --digest --include \
  --header "Accept: application/vnd.atlas.2023-01-01+json" \
  -X GET "https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers?pretty=true"
Response examples (200)
{
  "links": [
    {
      "href": "https://cloud.mongodb.com/api/atlas",
      "rel": "self"
    }
  ],
  "results": [
    {
      "awsIAMType": "NONE",
      "databaseName": "admin",
      "deleteAfterDate": "2025-05-04T09:42:00Z",
      "labels": [
        {
          "key": "string",
          "value": "string"
        }
      ],
      "ldapAuthType": "NONE",
      "links": [
        {
          "href": "https://cloud.mongodb.com/api/atlas",
          "rel": "self"
        }
      ],
      "oidcAuthType": "NONE",
      "roles": [
        {
          "collectionName": "string",
          "databaseName": "string",
          "roleName": "atlasAdmin"
        }
      ],
      "scopes": [
        {
          "name": "string",
          "type": "CLUSTER"
        }
      ],
      "username": "string",
      "x509Type": "NONE"
    }
  ],
  "totalCount": 42
}
Response examples (401)
{
  "error": 401,
  "detail": "(This is just an example, the exception may not be related to this endpoint)",
  "reason": "Unauthorized",
  "errorCode": "NOT_ORG_GROUP_CREATOR"
}
Response examples (500)
{
  "error": 500,
  "detail": "(This is just an example, the exception may not be related to this endpoint)",
  "reason": "Internal Server Error",
  "errorCode": "UNEXPECTED_ERROR"
}