Rippling: List app users — response body — results item
List app users: response body, field results / item. Complete fields and constraints for contract 2026-10-28.
API reference · Contract 2026-10-28
SDK schema: List app users — response body — results item
| Field | Type | Presence | Description and constraints |
|---|---|---|---|
$ | object | Root | Maps a Rippling worker (if any) to their user account in a third-party app (e.g. Slack, Jira, GitHub). Sourced from SpokeUser records. Includes orphan accounts — third-party app accounts with no matching Rippling worker (`worker_id=None`, `match_state=NOT_MATCHED`). These are the primary signal for IT-admin triage. Uses `BaseResourceDTO` rather than `BaseEmployeeResourceDTO` so the platform’s role-based auto-filter does not silently drop orphans for non-admin tokens. Company scoping is enforced explicitly in `AppUsersAPIViewSet.get_queryset`; the `app-users.read` scope is the access gate. Resource name aligns with how the product surfaces these in the UI (“Slack account”, “GitHub account”) and matches the equivalent concept in Okta’s IAM API (AppUser). Designed for point lookups: list endpoint requires at least one filter on `worker_id` or `spoke_user_identifier` to prevent bulk enumeration of the org’s identity graph across connected apps. `spoke_user_identifier` reads `SpokeUser.spokeId` — the user identifier stored for the third-party account. Depending on the integration, this may be an email, username, account handle, or app-specific user id. |
app_display_name | string | Optional | Human-readable display name for the third-party app (e.g. ‘Slack’, ‘GitHub’). Sourced from the customer-configured SpokeOwner.app_display_name; falls back to a title-cased app handle when the customer hasn’t set one. |
app_handle | string | Optional | Machine-readable identifier for the third-party app (e.g. ‘slack’, ‘jira’, ‘asana’). Stable across the App Shop catalog. |
created_at | string | Required within parent | Record creation date |
external_email | string | Optional | The user’s email address in the third-party app, if known. Null when the app does not expose an email or Rippling did not capture one. |
external_username | string | Optional | The user’s display name in the third-party app, if known. Null when the app does not surface a separate username. |
id | string | Required within parent | Identifier field |
match_state | string | Optional | Whether this third-party account has been matched to a Rippling worker. Known values: MATCHED, NOT_MATCHED, IGNORED |
push_state | string | Optional | Provisioning lifecycle state of this account in the third-party app. Known values: INIT, EMPLOYEE_CONFIRMATION_PENDING, EMPLOYEE_CONFIRMATION_ACCEPTED, EMPLOYEE_CONFIRMATION_REJECTED, INVITE_PENDING, INVITE_CONFIRMED, INVITE_FAILED, CREATE_PENDING, CREATE_CONFIRMED, CREATE_FAILED, DELETE_PENDING, DELETE_CONFIRMED, DELETE_FAILED, SUSPEND_PENDING, SUSPEND_CONFIRMED, SUSPEND_FAILED |
spoke_user_identifier | string | Optional | Identifier for the user’s account in the third-party app workspace. Depending on the integration, this may be an email, username, account handle, or app-specific user id. |
updated_at | string | Required within parent | Record update date |
worker | Model | Optional | Expand Retrieve a specific app user — response body — worker |
worker_id | string | Optional | ID of the Rippling worker associated with this external app account. |
Referenced models: Retrieve a specific app user — response body — worker