MotherDuck's Admin API can now list every user and service account

MotherDuck, a DuckDB-based cloud analytics service, has added a way to see everyone with access to an organization through its Admin API. According to the company's release notes, an entry dated October 8, 2026 says a GET request to /v1/users "returns every user and service account in your organization."

What is new. The release note describes two kinds of controls on the endpoint. The first is a pair of filters, one named is_service_account and one named is_deprovisioned. The second is paging through limit and offset parameters. Together, these suggest a caller can pull a large account roster in pieces and narrow it to a subset. That is our reading of the parameter names; the note does not spell out how the filters behave or whether they can be combined.

What is confirmed. The only confirmation is MotherDuck's own release note. It states that the endpoint exists, that it covers both human users and service accounts, that the two filters exist, and that paging uses limit and offset. The note points readers to the company's "Manage service accounts and tokens" material for examples.

What remains uncertain. The release note is short. It does not give response fields, the default or maximum page size, the permissions a caller needs, or whether deprovisioned accounts are included unless a filter is set. It also does not say how the endpoint is meant to be used. Claims that it suits audits, custom tooling or lifecycle management are plausible inferences, not statements from MotherDuck. We have found no independent report on the change, so this item rests on a single company source, and the details above should be checked against MotherDuck's Admin API reference before anyone builds on them. MotherDuck's endpoint reference page, which we did not use as a source, describes token-based paging, so paging details may differ from the release note.

Why it might matter. This is our inference, not a MotherDuck claim. If the filters work as their names suggest, administrators could list service accounts, or deprovisioned accounts, through the API instead of the Settings pages. The note does not say so, and how useful that would be depends on the details it leaves out.

The same release-notes page lists several other additions from the same period, but they are unrelated to this endpoint and are not covered here.

Revised 16 October 2026: Guth re-read the original sources and rewrote this article. The earlier version remains available as revision 1.