---
title: "runZero users and groups"
---

## ((User search)) keywords

When viewing users, you can use the keywords in this section to search and filter.

### Email {#users-email}

Use the syntax `email:<address>` to search for someone by email address.
```plaintext
email:john@example.com
```

### Name {#users-name}

Use the syntax `name:<text>` to search for someone by name.
```plaintext
name:john
```
```plaintext
name:"John Smith"
```

### Superuser {#users-superuser}

To search for people based on whether they have superuser access, use the term `superuser:<boolean>`.
```plaintext
superuser:true
```
```plaintext
superuser:f
```

### Access {#users-access}

Use the syntax `access:<term>` to search for users with a specific access level. Possible access levels are `admin`, `user`, `annotator`, `viewer`, `billing` and `none`.
```plaintext
access:admin
```

### Status {#users-status}

To search for users by invitation status, use the term `status:<text>`. Possible status values are `activated`, `pending` and `expired`.
```plaintext
status:pending
```

### SSO {#users-sso}

To search for people based on whether they can only sign in via SSO, use the term `sso:<boolean>`.
```plaintext
sso:true
```

### MFA {#users-mfa}

To search for people based on whether they have enrolled an MFA token, use the term `mfa:<boolean>`.
```plaintext
mfa:f
```

### Group ID {#users-groupID}

The `group_id` field is the unique identifier for a given group, written as a UUID. To search for users that are part of a group based on the group's ID, use the syntax `group_id:<uuid>`. 
```plaintext
group_id:cdb084f9-4811-445c-8ea1-3ea9cf88d536
```

### Group name {#users-groupName}

To search for users that are part of a group based on the group's name, use the syntax `group_name:<text>`.
```plaintext
group_name:administrators
```
```plaintext
group_name:"Temp annotators"
```
### User groups {#users-userGroups}

To search for users based on whether they are part of a group or not, use the term `has_group:<boolean>`. Use boolean value `t` or `true` to show all users who are members of a group. 

```plaintext
has_group:t
```
Conversely, use boolean value `f` or `false` to show users who are not members of a group. 

```plaintext
has_group:f
```
### Group count {#users-group-count}

Use the syntax `group_count:<number>`to search the group membership count.
This search term supports numerical comparison operators (`>`, `>=`, `<`, `<=`, `=`).

```plaintext
group_count:>1
```
```plaintext
group_count:=0
```

## ((Group search)) keywords

When viewing your groups, you can use the keywords in this section to search and filter.

### ID {#groups-ID}

The ID field is the unique identifier for a given group, written as a UUID. Use the syntax `id:<uuid>` to filter by ID field.
```plaintext
id:cdb084f9-4811-445c-8ea1-3ea9cf88d536
```

### Name {#groups-name}

Use the syntax `name:<text>` to search by group name.
```plaintext
name:administrators
```
```plaintext
name:"Temp annotators"
```

### Access {#groups-access}

Use the syntax `access:<term>` to search for groups with a specific access level. Possible access levels are `admin`, `user`, `annotator`, `viewer`, `billing` and `none`.
```plaintext
access:admin
```

### Timestamps (created at, updated at) {#groups-timestamps}

Filter groups by their timestamp fields, `created_at` and `updated_at`, using the syntax `created_at:<term>` and `updated_at:<term>`. The terms support the standard runZero [time comparison syntax][time].
```plaintext
created_at:<30days
```
```plaintext
updated_at:<1week
```

### Expiration {#groups-expiration}

Filter groups by their expiration timestamp, `expires_at`, using the syntax `expires_at:<term>`. The term supports the standard runZero [time comparison syntax][time].
```plaintext
expires_at:<30days
```
```plaintext
expires_at:>8/1/2019
```

The `expired` property describes whether or not a group has expired. Search this property using the `expired:<boolean>` syntax.

The term is a boolean value:

- `true`, `t`, `1`, and `yes` represent _true_
- `false`, `f`, `0`, and `no` represent _false_

```plaintext
expired:true
```
```plaintext
expired:0
```

Use the syntax `has_expiration:<term>` to find any assets with an expiration date.

The term is a boolean value:

- `true`, `t`, `1`, and `yes` represent _true_
- `false`, `f`, `0`, and `no` represent _false_

```plaintext
has_expiration:true
```
```plaintext
has_expiration:0
```

### Email {#groups-email}

The `created_by_email` property holds the email address for the user that created the group. It can be searched using the syntax `created_by_email:<term>`.
```plaintext
created_by_email:user@runzero.com
```


## ((Group mapping search)) keywords

When viewing your SSO group mappings, you can use the keywords in this section to search and filter.

### ID {#mapping-ID}

The ID field is the unique identifier for a given group mapping, written as a UUID. Use the syntax `id:<uuid>` to filter by ID field.
```plaintext
id:cdb084f9-4811-445c-8ea1-3ea9cf88d536
```

### SSO attribute {#mapping-ssoAttr}

The `sso_attribute` is the name of the attribute field to check for matching values. Use the syntax `sso_attribute:<text>` to search by `sso_attribute`.

```plaintext
sso_attribute:department
```

### SSO value {#mapping-ssoValue}

The `sso_value` is the value or comma-separated list of values to match. Use the syntax `sso_value:<text>` to search by `sso_value`.

```plaintext
sso_value:security
```
```plaintext
sso_value:"admins, administrators"
```

### Group ID {#mapping-groupID}

The `group_id` field is the unique identifier for a given group, written as a UUID. To search for group mappings related to a group based on the group's ID, use the syntax `group_id:<uuid>`. 
```plaintext
group_id:cdb084f9-4811-445c-8ea1-3ea9cf88d536
```

### Group name {#mapping-groupName}

To search for group mappings related to a group based on the group's name, use the syntax `group_name:<text>`.
```plaintext
group_name:administrators
```
```plaintext
group_name:"Temp annotators"
```

### Timestamps (created at, updated at) {#mapping-timestamps}

Filter group mappings by their timestamp fields, `created_at` and `updated_at`, using the syntax `created_at:<term>` and `updated_at:<term>`. The terms support the standard runZero [time comparison syntax][time].
```plaintext
created_at:<30days
```
```plaintext
updated_at:<1week
```

### Email {#mapping-email}

The `created_by_email` property holds the email address for the user that created the group. It can be searched using the syntax `created_by_email:<term>`.
```plaintext
created_by_email:user@runzero.com
```