> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getprimo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List local user accounts on a device

> Return the local user accounts provisioned on ONE device, each with its privilege level (`rights`: ADMIN / USER / UNKNOWN). Use this to find which accounts hold local administrator or standard user rights on a machine. For many devices at once, use `getDevicesUsers` instead of calling this endpoint in a loop.

<span className="badge-read">Key: Read</span><span className="badge-company">Scope: Company</span>


## OpenAPI

````yaml https://api.getprimo.com/openapi.json get /devices/{deviceId}/users
openapi: 3.1.1
info:
  title: Public API - BETA
  description: Read docs on https://docs.getprimo.com/
  version: '1.0'
  contact: {}
servers:
  - url: https://api.getprimo.com
security:
  - apikey: []
tags: []
paths:
  /devices/{deviceId}/users:
    get:
      tags:
        - Devices
      summary: List local user accounts on a device
      description: >-
        Return the local user accounts provisioned on ONE device, each with its
        privilege level (`rights`: ADMIN / USER / UNKNOWN). Use this to find
        which accounts hold local administrator or standard user rights on a
        machine. For many devices at once, use `getDevicesUsers` instead of
        calling this endpoint in a loop.
      operationId: getDeviceUsers
      parameters:
        - name: deviceId
          required: true
          in: path
          schema:
            type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetDeviceUsers_Output'
components:
  schemas:
    GetDeviceUsers_Output:
      type: object
      properties:
        users:
          type: array
          items:
            type: object
            properties:
              id:
                type: string
              username:
                type: string
              uid:
                description: Platform-level user identifier (e.g. macOS UID), when known.
                anyOf:
                  - type: string
                  - type: 'null'
              rights:
                description: >-
                  Local privilege level of the account on the device. ADMIN =
                  local administrator, USER = standard user, UNKNOWN = not yet
                  reported by the MDM.
                type: string
                enum:
                  - ADMIN
                  - USER
                  - UNKNOWN
              accountType:
                description: Always LOCAL — only on-device local accounts are returned.
                type: string
                enum:
                  - LOCAL
                  - REMOTE
              groupName:
                anyOf:
                  - type: string
                  - type: 'null'
              secureTokenGranted:
                description: 'macOS: whether the account holds a SecureToken.'
                anyOf:
                  - type: boolean
                  - type: 'null'
              password:
                description: >-
                  Current account password in plaintext, when Primo manages it;
                  null when unknown/unmanaged.
                anyOf:
                  - type: string
                  - type: 'null'
            required:
              - id
              - username
              - uid
              - rights
              - accountType
              - groupName
              - secureTokenGranted
              - password
            additionalProperties: false
      required:
        - users
      additionalProperties: false
  securitySchemes:
    apikey:
      scheme: bearer
      bearerFormat: API key
      type: http
      description: >-
        Use your Primo API key in the Authorization header as `Bearer
        <API_KEY>`.

````