Yes! FusionAuth stores MFA details on the user object, and you can search for users with MFA enabled using Elasticsearch queries.

For example, in the Admin UI’s User search, you can run:

_exists_:twoFactor

This returns all users with at least one MFA method configured. You can also perform similar searches via the User Search API to build custom reports. For more details on searchable user fields and Elasticsearch queries, see:

User Fields Reference User Search with Elasticsearch

You’re correct that the Login Records report in FusionAuth only allows searches for individual users by their unique ID or email address. Unfortunately, it’s not possible to search login records directly by email domain through the UI or built-in report filters.

To achieve what you’re looking for, you’ll need to export the login records using FusionAuth’s Export Login Records API. Once you have the data exported (for example, as a CSV), you can then filter the records offline to identify users from a specific domain who logged in during your desired time frame.

You can read more about exporting login records here:
Export Login Records API

Your request body looks correct for a basic search by email and should return a result if a user with that exact email address exists in your system.

1. Ensure You Are Using POST (or Use GET with Query Parameters)

The /api/user/search endpoint supports both POST and GET, but they expect different input formats.

If using GET, you must provide query parameters, such as:

GET /api/user/search?ids=<user_id>

2. Searching for Partial Matches

If you want to find all users with a certain email domain, try using a wildcard search:

{ "search": { "queryString": "*@email.com" } }

3. Verify API Key Permissions

If you still get empty results, ensure that:

Your API key has sufficient permissions to query user data. The user records exist in the database.

4. Further Reading on User Search

For more details on how to construct search queries, refer to:

Elasticsearch Search in FusionAuth User Search with Elasticsearch

Looking at https://github.com/FusionAuth/fusionauth-java-client/blob/master/src/main/java/io/fusionauth/client/FusionAuthClient.java#L3256

It appears there is no way to search using the Java client that uses a GET, only a POST. However, you can still provide the queryString in the JSON and it will be equivalent to the GET request.

Building this JSON:

{ "search": { "queryString": "fusionauth.io" } }

Is equivalent to queryString=fusionauth.io.

Hope that helps.

Try clicking on the Advanced section on the User Search page and see you find what you're looking for.

Or search like this tenantId:9d92ca33-bc7b-4d13-acd7-f7dc06038396 where 9d92ca33-bc7b-4d13-acd7-f7dc06038396 is your tenantId.

Please note that this is an example for the elastic search search engine. With the database search engine, you can only search for the fields as documented in the API. As of this post, those are:

firstName lastName fullName email username

I don't know of any issues. You’re mainly just giving up the ability to perform rich queries. The db search is a few LIKE statements.

I don't think we've tested millions running db search - but the only issue I can think of for normal usage would be the User page in the UI since we’ll be paginating over lots of users.

This should work ok - but pagination tends to slow way down as you get into higher pages,.

One can always flip on Elastic and run an index, so not much harm in trying it.

From the user search docs, for the database search engine:

Regular expressions may not be used. A value of * will match all records.

For the elasticsearch search engine, you are limited to 10,000 records returned due to this bug: https://github.com/FusionAuth/fusionauth-issues/issues/494

Here's docs on how to switch between them: https://fusionauth.io/docs/v1/tech/tutorials/switch-search-engines

You should be able to go the user's tab and then expand the 'advanced' section and select a given application.

See this screenshot:

user search with 'advanced' section expanded

Hmmm. Since you haven't made any changes and aren't seeing any other errors, can you try to reindex?

Navigate to system and then re-index in the administrative user interface?

That should solve the issue.

Fix is live: https://github.com/FusionAuth/fusionauth-site/pull/147

You need to use the user search API with an elastic search query string.

Here's a curl example:

API_KEY=.... GROUP_ID=f4a64b10-1cf6-4289-84c0-c3035f3b78bc curl -H "Authorization: $API_KEY" 'http://localhost:9011/api/user/search/?queryString=memberships.groupId:'$GROUP_ID

If you are using the database search engine, you cannot find all the members of a group.

It depends on the issue, but there are two things you can do. Note that FusionAuth typically sends the query you post to the /api/user/search endpoint with the query parameter straight through to Elasticsearch

First, ensure you are running elasticsearch and not the database search engine.

Then, for some queries you can see the generate ElasticSearch query strings by clicking on the 'advanced' option in the user search area of the admin UI. This can be helpful.

Finally, try running the query directly against elasticsearch and seeing if it works. Here are examples which will pull back all the data in your elasticsearch cluster (beware!).

curl -XPOST -H 'Content-type: application/json' "http://localhost:9021/_search" -d' { "query": { "match_all": {} } }'

or, if you have the query stored in query.json

curl -XPOST -H 'Content-type: application/json' "http://localhost:9021/_search" -d@query.json

Here's a doc about how to switch search engines: https://fusionauth.io/docs/v1/tech/tutorials/switch-search-engines

@le-nnyburkdoll

This guide might be helpful to you: https://fusionauth.io/docs/v1/tech/guides/user-search-with-elasticsearch

Thanks,
Dan

You can search on the user id. While it doesn't say that in the placeholder, it works.

Hello
It depends on the specific system or platform you are using. You may need to consult its documentation or support resources.