> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nasiko.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Search the user directory. The user directory (usernames + emails) is

> Search the user directory. The user directory (usernames + emails) is
sensitive (CAT-4), so results are scoped via `AuthService::org_visible_user_ids`
— OSS returns `None` (unrestricted, no org hierarchy to scope by); EE
restricts non-admin callers to their own department/team, same as the MCP
share-target picker (`oss/mcp-gateway`'s `search_share_targets_view`).
An exact username/display-name match bypasses that scope, mirroring
`resolve_share_target`/`departments.rs::resolve`/`teams.rs::resolve` —
a caller who already knows exactly who they're looking for (e.g. a
connector owner sharing outside their own team) can still find them by
typing the full name, they just can't browse/enumerate people outside
their scope via a partial query.



## OpenAPI

````yaml /api-reference/openapi.json get /api/search/users
openapi: 3.1.0
info:
  title: Nasiko API
  description: >-
    HTTP API for the Nasiko OpenRuntime: agents, coding harnesses, TokenOps,
    routing, MCP, and secrets. Spec is generated from annotated routes; some
    surfaces are documented on the hand-written pages alongside this file.
  license:
    name: ''
  version: 0.1.0
servers: []
security: []
tags:
  - name: secrets
    description: Encrypted per-user agent secrets
  - name: catalog
    description: >-
      Agent catalog: registration, discovery, versions, per-agent secrets, and
      source import
  - name: agents
    description: >-
      Agent lifecycle: deployments, LLM routing config, update/rollback,
      upload-and-deploy
  - name: orchestrator
    description: >-
      A2A dispatch: routing-engine/ReAct orchestrator and direct agent chat,
      plus routing stats
  - name: users
    description: >-
      User management: CRUD, roles, credentials, accessible agents
      (superuser-only)
  - name: usage
    description: Per-user token usage and cost reporting
  - name: observability
    description: Sessions, traces, spans, agent logs, and FinOps reporting
  - name: llm-router
    description: LLM routing presets, provider/model catalog, and tier→model registry
  - name: mcp
    description: >-
      MCP gateway: agent-facing JSON-RPC tool calls, connector
      registration/upload/sharing, credentials & OAuth, and per-agent tool
      permissions
paths:
  /api/search/users:
    get:
      tags:
        - catalog
      summary: Search the user directory. The user directory (usernames + emails) is
      description: >-
        Search the user directory. The user directory (usernames + emails) is

        sensitive (CAT-4), so results are scoped via
        `AuthService::org_visible_user_ids`

        — OSS returns `None` (unrestricted, no org hierarchy to scope by); EE

        restricts non-admin callers to their own department/team, same as the
        MCP

        share-target picker (`oss/mcp-gateway`'s `search_share_targets_view`).

        An exact username/display-name match bypasses that scope, mirroring

        `resolve_share_target`/`departments.rs::resolve`/`teams.rs::resolve` —

        a caller who already knows exactly who they're looking for (e.g. a

        connector owner sharing outside their own team) can still find them by

        typing the full name, they just can't browse/enumerate people outside

        their scope via a partial query.
      operationId: search_users
      parameters:
        - name: q
          in: query
          description: Search term, minimum 2 characters.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Ranked user search hits (max 50)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserSearchResponse'
        '400':
          description: '`q` shorter than 2 characters'
components:
  schemas:
    UserSearchResponse:
      type: object
      description: >-
        Response envelope for `/search/users` — documents the shape of the ad
        hoc

        `serde_json::json!` object the handler returns.
      required:
        - data
        - query
        - total_matches
        - showing
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/UserSearchResult'
        query:
          type: string
        showing:
          type: integer
          minimum: 0
        total_matches:
          type: integer
          minimum: 0
    UserSearchResult:
      type: object
      description: |-
        User search. Field boosts: username×3.0, display_name×2.5, email×1.5.
        Scoring: exact (100×boost) > prefix (90×boost) > contains (70×boost).
        Minimum query length: 2 chars. Sort: score DESC, username ASC.
        Returns all matching users (no limit).
      required:
        - id
        - username
        - display_name
        - email
        - score
      properties:
        display_name:
          type: string
        email:
          type: string
        id:
          type: string
          format: uuid
        role:
          type:
            - string
            - 'null'
        score:
          type: number
          format: double
        username:
          type: string

````