You can use the User Search API with a must_not clause in the Elasticsearch query to exclude users registered to a specific application. Here's an example:

curl -X POST https://sandbox.fusionauth.io/api/user/search \ -H 'Authorization: <your-api-key>' \ -H 'Content-Type: application/json' \ -d '{ "search": { "accurateTotal": true, "numberOfResults": 100, "startRow": 0, "query": "{\"bool\":{\"must_not\":[{\"nested\":{\"path\":\"registrations\",\"query\":{\"bool\":{\"must\":[{\"match\":{\"registrations.applicationId\":\"<your-application-id>\"}}]}}}}]}}" } }'

Key points:

The must_not clause excludes users matching the nested query The nested query targets the registrations path since registrations are nested objects in the Elasticsearch mapping Inside the nested query, the must clause matches the specific applicationId Replace <your-application-id> with the UUID of your target application This returns users who either have no registrations at all, or have registrations to other applications but not the specified one

You can paginate through results using startRow and numberOfResults if you have a large user base.

Important: This approach requires the Elasticsearch search engine (not the database engine). You must use the search.query parameter with raw Elasticsearch JSON when querying against registrations, because it is defined as a nested datatype in the Elasticsearch mapping. The queryString parameter cannot be used for nested fields like registrations with expected results.

Tip: You can use the Admin UI → Users → Advanced → Show Elasticsearch Query toggle to build and test queries interactively before using them in the API.

Related Documentation User Search API - Elasticsearch Search Engine - Main API reference for searching users with Elasticsearch Searching Users With Elasticsearch or OpenSearch - Searching With query - Guide on using the query parameter for advanced searches User Search API - Additional Query Examples - Examples of various query patterns including nested queries Registrations - Core concepts documentation explaining the relationship between Users, Applications, and Registrations Field Mappings - Available fields for matching in Elasticsearch searches

Yes, this does trigger an MAU increase.

Here's a list of what makes a user active during a month: https://fusionauth.io/docs/v1/tech/core-concepts/users#what-makes-a-user-active

Solution:

https://github.com/FusionAuth/go-client/issues/48

Yes. A user can have one-to-many refresh tokens per application.

The user and registration may have a username field. The username field on the user is the one that can be used to login. In general you will want to use the Search API for those types of queries rather than directly accessing the database.

The reason is because the API is documented and stable, and the database is undocumented and may change.

Referencing/linking below for future guidance for folks who view this post:

https://fusionauth.io/community/forum/topic/900/authentication-for-an-application-with-web-client-and-mobile-front-ends

If you want to use the breached password detection feature, then that check will be applied for any new account registrations.

You could always disable the breached password detection feature.

Sorry, I don't have a better answer for you.

You could use the skipVerification parameter (set it to true) on the user or registration create statement, and then the https://fusionauth.io/docs/v1/tech/apis/users#resend-verification-email call with sendVerifyEmail set to false.

This would give you a verificationId you could use with this API call: https://fusionauth.io/docs/v1/tech/apis/users#verify-a-users-email

@ashok glad you solved the problem!

The only problem is that I don't seem to be able to pass all the tokens and then "map" it out in the backend.

I'm not sure what you mean here. Are you not seeing all the tokens in the lambda? Or are you not able to put them all in the custom claim?

Also, I think I already know the answer to this and this may sound dumb, but how can you have multiple tokens? A user with multiple providers? If so, how are they consolidated and combined?

A token is tied to a registration/application, so someone could login with google to one FusionAuth application and with facebook to another. Unless I'm missing something, I don't believe they are combined.

Lastly, it would have been nice if user.registrations had a providers field.

We welcome your feature requests 🙂 . Please file a github issue: https://github.com/fusionauth/fusionauth-issues/issues