> This page is for API, version 2026-01-01 (Stable) (default). > For other versions, use one of these documentation indexes: > - 2026-01-01 (Stable) (default): https://developer.deel.com/api/stable/llms.txt > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://developer.deel.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developer.deel.com/_mcp/server. # List users assigned to an IT policy GET https://api.letsdeel.com/rest/it/policies/{policy_id}/users Lists the workers assigned to one of your organization's IT hardware policies. Use it to resolve which workers a policy applies to before raising equipment requests on their behalf, or to audit policy membership. Results are cursor-paginated. **Token scopes**: `it-policies:read` **Beta**: this version requires the `X-Beta: true` request header and its contract may change before it is promoted to stable. It is scheduled to become stable on 2026-12-17. Reference: https://developer.deel.com/api/deel-it/endpoints/it-policies/list-it-policy-users-v-2026-09-17 ## Authentication - `Authorization` header (bearer token, required) — ## Authentication The Deel API uses bearer tokens to authenticate requests. All API calls must be made over HTTPS — calls over plain HTTP or without authentication will fail. ```curl curl -X GET 'https://api.letsdeel.com/rest/v2/contracts' \ -H 'Authorization: Bearer YOUR-TOKEN-HERE' ``` [Learn more about authentication](/api/authentication) - `Authorization` header (bearer token, required) — Standard OAuth2 security scheme based on https://swagger.io/docs/specification/authentication/ ## Servers - `https://api.letsdeel.com/rest` (Production, default) - `https://api-staging.letsdeel.com/rest` (Demo) ## Request ### Path parameters - `policy_id` (string, required) — IT policy identifier ### Query parameters - `cursor` (string, optional) — Indicates where the next page of results starts, as returned in a paginated list response - `limit` (integer, optional, default: 20) — Return a page of results with given number of records - `hris_profile_id` (string, optional) — Filter by the worker's HRIS Profile ID, to find which policy a specific worker is attached to. Repeat the key to filter on multiple values. ### Headers - `X-Beta` (enum, required, default: true) — Opts in to the beta version of this endpoint. Must be `true`. - Allowed values: `true` ## Response ### 200 OK - `data` (list of ItPoliciesPolicyIdUsersGetResponsesContentApplicationJsonSchemaDataItems, required) - `has_more` (boolean, required) — Whether there are more results available - `next_cursor` (string, required, nullable) — Cursor to the next page - `total_count` (long, required) — Total number of records ## Errors ### 400 Bad Request Error Bad Request - `errors` (list of ItPoliciesPolicyIdUsersGetResponsesContentApplicationJsonSchemaErrorsItems, required) ### 401 Unauthorized Error Operation failed. - `request` (ApiErrorRequest, optional) - `errors` (list of ApiError, optional) ### 403 Forbidden Error Operation failed. - `request` (ApiErrorRequest, optional) - `errors` (list of ApiError, optional) ### 404 Not Found Error Not Found - `errors` (list of ItPoliciesPolicyIdUsersGetResponsesContentApplicationJsonSchemaErrorsItems, required) ### 500 Internal Server Error Internal Server Error - `errors` (list of ItPoliciesPolicyIdUsersGetResponsesContentApplicationJsonSchemaErrorsItems, required) ## Types ### ItPoliciesPolicyIdUsersGetResponsesContentApplicationJsonSchemaDataItems - `emails` (list of string, required) — Array of user email addresses - `address` (ItPoliciesPolicyIdUsersGetResponsesContentApplicationJsonSchemaDataItemsAddress, required) — User address details - `last_name` (string, required) — Last name of the user - `first_name` (string, required) — First name of the user - `hris_profile_id` (string, required) — The unique identifier of the HRIS profile of the assigned user ### ItPoliciesPolicyIdUsersGetResponsesContentApplicationJsonSchemaErrorsItems - `code` (string, required) — Error code of the handler which produced the returned error - `field` (string, required, nullable) — The field name where input validation failed - `message` (string, required) — Description of the returned error ### ApiErrorRequest - `method` (string, optional) — The HTTP method of the failed request - `url` (string, optional) — The relative URL of the failed request - `status` (double, optional) — The status code of the response - `api_req_id` (string, optional) — The request ID of the failed request - `docs` (string, optional) — A link to the official documentation for the requested endpoint resource - `source` (string, optional) — The source handler which produced the returned error - `code` (double, optional) — The code of the source handler which produced the returned error ### ApiError - `message` (string, optional) — A description of the returned error - `path` (string, optional) — The JSON path where input validation failed ### ItPoliciesPolicyIdUsersGetResponsesContentApplicationJsonSchemaDataItemsAddress User address details - `id` (string, required) — Unique identifier of the address - `city` (string, required, nullable) — City name - `type` (enum, required) — Type of the address - Allowed values: `BILLING`, `COLLECTION`, `DELIVERY`, `ENTITY`, `PARTIAL`, `PII`, `SUPPLIER` - `line1` (string, required, nullable) — Address line 1 - `line2` (string, required, nullable) — Address line 2 - `state` (string, required, nullable) — State code or name - `country` (enum, required) — Country code - Allowed values: `AD`, `AE`, `AF`, `AG`, `AI`, `AL`, `AM`, `AN`, `AO`, `AQ`, `AR`, `AS`, `AT`, `AU`, `AW`, `AX`, `AZ`, `BA`, `BB`, `BD`, `BE`, `BF`, `BG`, `BH`, `BI`, `BJ`, `BL`, `BM`, `BN`, `BO`, `BQ`, `BR`, `BS`, `BT`, `BV`, `BW`, `BY`, `BZ`, `CA`, `CC`, `CD`, `CF`, `CG`, `CH`, `CI`, `CK`, `CL`, `CM`, `CN`, `CO`, `CR`, `CU`, `CV`, `CW`, `CX`, `CY`, `CZ`, `DE`, `DJ`, `DK`, `DM`, `DO`, `DZ`, `EC`, `EE`, `EG`, `EH`, `ER`, `ES`, `ET`, `FI`, `FJ`, `FK`, `FM`, `FO`, `FR`, `GA`, `GB`, `GD`, `GE`, `GF`, `GG`, `GH`, `GI`, `GL`, `GM`, `GN`, `GP`, `GQ`, `GR`, `GS`, `GT`, `GU`, `GW`, `GY`, `HK`, `HM`, `HN`, `HR`, `HT`, `HU`, `IC`, `ID`, `IE`, `IL`, `IM`, `IN`, `IO`, `IQ`, `IR`, `IS`, `IT`, `JE`, `JM`, `JO`, `JP`, `KE`, `KG`, `KH`, `KI`, `KM`, `KN`, `KP`, `KR`, `KW`, `KY`, `KZ`, `LA`, `LB`, `LC`, `LI`, `LK`, `LR`, `LS`, `LT`, `LU`, `LV`, `LY`, `MA`, `MC`, `MD`, `ME`, `MF`, `MG`, `MH`, `MK`, `ML`, `MM`, `MN`, `MO`, `MP`, `MQ`, `MR`, `MS`, `MT`, `MU`, `MV`, `MW`, `MX`, `MY`, `MZ`, `NA`, `NC`, `NE`, `NF`, `NG`, `NI`, `NL`, `NO`, `NP`, `NR`, `NU`, `NZ`, `OM`, `PA`, `PE`, `PF`, `PG`, `PH`, `PK`, `PL`, `PM`, `PN`, `PR`, `PS`, `PT`, `PW`, `PY`, `QA`, `RE`, `RO`, `RS`, `RU`, `RW`, `SA`, `SB`, `SC`, `SD`, `SE`, `SG`, `SH`, `SI`, `SJ`, `SK`, `SL`, `SM`, `SN`, `SO`, `SR`, `SS`, `ST`, `SV`, `SX`, `SY`, `SZ`, `TC`, `TD`, `TF`, `TG`, `TH`, `TJ`, `TK`, `TL`, `TM`, `TN`, `TO`, `TR`, `TT`, `TV`, `TW`, `TZ`, `UA`, `UG`, `US`, `UY`, `UZ`, `VA`, `VC`, `VE`, `VG`, `VI`, `VN`, `VU`, `WF`, `WS`, `XK`, `YE`, `YT`, `ZA`, `ZM`, `ZW` - `is_valid` (boolean, required) — Whether the address passes validation - `post_code` (string, required, nullable) — Post code - `phone_number` (string, required, nullable) — Phone number - `date_of_birth` (string, required, nullable) — Date of birth (applicable for some address types) - `tax_id_number` (string, required, nullable) — Tax ID number (applicable for some address types) - `passport_number` (string, required, nullable) — Passport number (applicable for some address types) - `delivery_instructions` (string, required, nullable) — Special instructions for deliveries ## Examples **Response** ```json { "data": [ { "emails": [ "bruce.wayne@wayne-enterprise.com", "batman@gotham.com" ], "address": { "id": "550e8400-e29b-41d4-a716-446655440000", "city": "Gotham", "type": "DELIVERY", "line1": "1007 Mountain Drive", "line2": "Stately Wayne Manor", "state": "New Jersey", "country": "US", "is_valid": true, "post_code": "12345", "phone_number": "+1-212-456-7890", "date_of_birth": "1997-12-18", "tax_id_number": "BAT123456", "passport_number": "P123456789", "delivery_instructions": "Use the Bat-Signal if urgent" }, "last_name": "Wayne", "first_name": "Bruce", "hris_profile_id": "550e8400-e29b-41d4-a716-446655440000" } ], "has_more": true, "next_cursor": "d3m0d3m0d3m0d3m0d3m0d3m0d3m0d3m0d3m0d3m", "total_count": 133 } ``` **SDK Code** ```python import requests url = "https://api.letsdeel.com/rest/it/policies/550e8400-e29b-41d4-a716-446655440000/users" querystring = {"cursor":"d3m0d3m0d3m0d3m0d3m0d3m0d3m0d3m0d3m0d3m","hris_profile_id":"550e8400-e29b-41d4-a716-446655440000","limit":"10"} headers = { "X-Beta": "true", "Authorization": "Bearer " } response = requests.get(url, headers=headers, params=querystring) print(response.json()) ``` ```javascript const url = 'https://api.letsdeel.com/rest/it/policies/550e8400-e29b-41d4-a716-446655440000/users?cursor=d3m0d3m0d3m0d3m0d3m0d3m0d3m0d3m0d3m0d3m&hris_profile_id=550e8400-e29b-41d4-a716-446655440000&limit=10'; const options = {method: 'GET', headers: {'X-Beta': 'true', Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go package main import ( "fmt" "net/http" "io" ) func main() { url := "https://api.letsdeel.com/rest/it/policies/550e8400-e29b-41d4-a716-446655440000/users?cursor=d3m0d3m0d3m0d3m0d3m0d3m0d3m0d3m0d3m0d3m&hris_profile_id=550e8400-e29b-41d4-a716-446655440000&limit=10" req, _ := http.NewRequest("GET", url, nil) req.Header.Add("X-Beta", "true") req.Header.Add("Authorization", "Bearer ") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby require 'uri' require 'net/http' url = URI("https://api.letsdeel.com/rest/it/policies/550e8400-e29b-41d4-a716-446655440000/users?cursor=d3m0d3m0d3m0d3m0d3m0d3m0d3m0d3m0d3m0d3m&hris_profile_id=550e8400-e29b-41d4-a716-446655440000&limit=10") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Get.new(url) request["X-Beta"] = 'true' request["Authorization"] = 'Bearer ' response = http.request(request) puts response.read_body ``` ```java import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.get("https://api.letsdeel.com/rest/it/policies/550e8400-e29b-41d4-a716-446655440000/users?cursor=d3m0d3m0d3m0d3m0d3m0d3m0d3m0d3m0d3m0d3m&hris_profile_id=550e8400-e29b-41d4-a716-446655440000&limit=10") .header("X-Beta", "true") .header("Authorization", "Bearer ") .asString(); ``` ```php request('GET', 'https://api.letsdeel.com/rest/it/policies/550e8400-e29b-41d4-a716-446655440000/users?cursor=d3m0d3m0d3m0d3m0d3m0d3m0d3m0d3m0d3m0d3m&hris_profile_id=550e8400-e29b-41d4-a716-446655440000&limit=10', [ 'headers' => [ 'Authorization' => 'Bearer ', 'X-Beta' => 'true', ], ]); echo $response->getBody(); ``` ```csharp using RestSharp; var client = new RestClient("https://api.letsdeel.com/rest/it/policies/550e8400-e29b-41d4-a716-446655440000/users?cursor=d3m0d3m0d3m0d3m0d3m0d3m0d3m0d3m0d3m0d3m&hris_profile_id=550e8400-e29b-41d4-a716-446655440000&limit=10"); var request = new RestRequest(Method.GET); request.AddHeader("X-Beta", "true"); request.AddHeader("Authorization", "Bearer "); IRestResponse response = client.Execute(request); ``` ```swift import Foundation let headers = [ "X-Beta": "true", "Authorization": "Bearer " ] let request = NSMutableURLRequest(url: NSURL(string: "https://api.letsdeel.com/rest/it/policies/550e8400-e29b-41d4-a716-446655440000/users?cursor=d3m0d3m0d3m0d3m0d3m0d3m0d3m0d3m0d3m0d3m&hris_profile_id=550e8400-e29b-41d4-a716-446655440000&limit=10")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "GET" request.allHTTPHeaderFields = headers let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```