> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getprimo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List local user accounts on multiple devices

> Return the local user accounts provisioned on MULTIPLE devices in one call, grouped by device id, each account with its privilege level (`rights`: ADMIN / USER / UNKNOWN). Use this to answer fleet-wide questions such as "which users hold local administrator rights on their machine": list the devices with `getDevices` or `searchDevices`, then pass their ids here. Provide a list of `deviceIds` (up to 200 per call). Prefer this over calling `getDeviceUsers` once per device.

<span className="badge-read">Key: Read</span><span className="badge-company">Scope: Company</span>


## OpenAPI

````yaml https://api.getprimo.com/openapi.json post /devices/users
openapi: 3.1.1
info:
  title: Public API - BETA
  description: Read docs on https://docs.getprimo.com/
  version: '1.0'
  contact: {}
servers:
  - url: https://api.getprimo.com
security:
  - apikey: []
tags: []
paths:
  /devices/users:
    post:
      tags:
        - Devices
      summary: List local user accounts on multiple devices
      description: >-
        Return the local user accounts provisioned on MULTIPLE devices in one
        call, grouped by device id, each account with its privilege level
        (`rights`: ADMIN / USER / UNKNOWN). Use this to answer fleet-wide
        questions such as "which users hold local administrator rights on their
        machine": list the devices with `getDevices` or `searchDevices`, then
        pass their ids here. Provide a list of `deviceIds` (up to 200 per call).
        Prefer this over calling `getDeviceUsers` once per device.
      operationId: getDevicesUsers
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GetDevicesUsersBody'
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetDevicesUsers_Output'
components:
  schemas:
    GetDevicesUsersBody:
      type: object
      properties:
        deviceIds:
          description: Device ids to fetch local user accounts for. Up to 200 per call.
          minItems: 1
          maxItems: 200
          type: array
          items:
            type: string
      required:
        - deviceIds
    GetDevicesUsers_Output:
      type: object
      properties:
        items:
          type: array
          description: Local user accounts grouped by device id.
          items:
            type: object
            properties:
              deviceId:
                type: string
              users:
                description: >-
                  Local user accounts on this device. Empty when the device has
                  no local account, does not exist, or does not belong to your
                  company.
                type: array
                items:
                  type: object
                  properties:
                    id:
                      type: string
                    username:
                      type: string
                    uid:
                      description: >-
                        Platform-level user identifier (e.g. macOS UID), when
                        known.
                      anyOf:
                        - type: string
                        - type: 'null'
                    rights:
                      description: >-
                        Local privilege level of the account on the device.
                        ADMIN = local administrator, USER = standard user,
                        UNKNOWN = not yet reported by the MDM.
                      type: string
                      enum:
                        - ADMIN
                        - USER
                        - UNKNOWN
                    accountType:
                      description: >-
                        Always LOCAL — only on-device local accounts are
                        returned.
                      type: string
                      enum:
                        - LOCAL
                        - REMOTE
                    groupName:
                      anyOf:
                        - type: string
                        - type: 'null'
                    secureTokenGranted:
                      description: 'macOS: whether the account holds a SecureToken.'
                      anyOf:
                        - type: boolean
                        - type: 'null'
                    password:
                      description: >-
                        Current account password in plaintext, when Primo
                        manages it; null when unknown/unmanaged.
                      anyOf:
                        - type: string
                        - type: 'null'
                  required:
                    - id
                    - username
                    - uid
                    - rights
                    - accountType
                    - groupName
                    - secureTokenGranted
                    - password
                  additionalProperties: false
            required:
              - deviceId
              - users
            additionalProperties: false
      required:
        - items
      additionalProperties: false
  securitySchemes:
    apikey:
      scheme: bearer
      bearerFormat: API key
      type: http
      description: >-
        Use your Primo API key in the Authorization header as `Bearer
        <API_KEY>`.

````