LastPass

Manage LastPass Business users - add, update, disable, re-enable and remove them, change their groups, reset master passwords and multifactor, log them out - and audit the account through its event log, shared folders and master password expiry reports.

Actions

Action	What it does
Add user	Add a user to LastPass Business.
Change user email	Change a user's account email (their username).
Delete user	Disable a user, remove them from LastPass Business, delete their account and vault permanently, or revoke a pending invitation.
Disable multifactor	Turn off a user's multifactor authentication, for example when they have lost their authenticator.
Disable users	Disable up to 100 users: they can no longer sign in, but their accounts and data are kept.
Enable users	Re-activate disabled users so they can sign in again.
Get password iterations	Get your account's default master password iteration count (the number of hashing rounds; 600,000 by default).
Get user	Get one user by email address: their status, last sign-in, security score, item counts and groups.
List events	Read the audit log between two times, newest first: sign-ins, failed sign-ins, admin changes and vault activity, for every user or one.
List expired master passwords	List active users whose master password has expired under your password policy (federated users are not included).
List expiring master passwords	List users whose master password will expire within 7 days, to remind them before it does.
List shared folders	List every shared folder with its security score and the users it is shared with, including their permissions.
List shared folders (detailed)	List shared folders as above, plus the sites each member can reach (LastPass returns these URLs encrypted).
List users	List a page of the users in your LastPass Business account, with their security scores, item counts and groups, optionally only enrolled or disabled users, or only admins.
Log out user	End every LastPass session a user has open, on every device.
Reinvite user	Send a user who has not yet joined their LastPass Business invitation again.
Require master password change	Make a user change their master password the next time they sign in.
Send password reset email	Email a user a link to reset their master password.
Update user	Change a user's full name, Duo Security username or RSA SecurID username.
Update user groups	Add a user to groups and remove them from others in one step.

Add user

Add a user to LastPass Business. LastPass emails them an invitation; optionally put them in groups and give them a starting master password.

Inputs

Username (email)usernametextRequired: The new user's email address. It becomes their LastPass username.
Full namefull_nametext: The user's full name.
Groupsgroupslist: Groups to put the user in. Pick existing ones or type a name.
Starting master passwordpasswordtext: Optional. A master password for the new account; leave empty to let the user choose their own from the invitation.
Require password changerequire_password_changetrue/false: With a starting password: make the user change it at first sign-in. LastPass does so by default.

Outputs

fullnametext
groupslist
password_reset_requiredtrue/false
password_settrue/false
statustext
usernametext

Example output

{
  "fullname": "Jane Doe",
  "groups": [
    "Engineering"
  ],
  "password_reset_required": null,
  "password_set": false,
  "status": "OK",
  "username": "jane.doe@example.com"
}

Change user email

Change a user's account email (their username). The change completes when the user next signs in with their old email and master password.

Inputs

Current emailold_emailtextRequired: The user's current account email.
New emailnew_emailtextRequired: The email the account should move to.

Outputs

new_emailtext
old_emailtext
statustext

Example output

{
  "new_email": "jane@example.org",
  "old_email": "jane.doe@example.com",
  "status": "OK"
}

Delete user

Disable a user, remove them from LastPass Business, delete their account and vault permanently, or revoke a pending invitation.

Inputs

Username (email)usernametextRequired: The user's email address - their LastPass username. Use List users to find one.
What to dodelete_actiontextRequired: Permanent deletion erases the user's vault and cannot be undone.One of: 0 (Disable the account (blocks sign-in, keeps its data)), 1 (Remove from LastPass Business (the user keeps a personal account)), 2 (Delete the account and its vault permanently - cannot be undone), 3 (Uninvite (revoke a pending invitation)). Default: 0.

Outputs

delete_actionnumber
delete_action_labeltext
statustext
usernametext

Example output

{
  "delete_action": 0,
  "delete_action_label": "Disable the account (blocks sign-in, keeps its data)",
  "status": "OK",
  "username": "jane.doe@example.com"
}

Disable multifactor

Turn off a user's multifactor authentication, for example when they have lost their authenticator.

Inputs

Username (email)usernametextRequired: The user's email address - their LastPass username. Use List users to find one.

Outputs

statustext
usernametext

Example output

{
  "status": "OK",
  "username": "jane.doe@example.com"
}

Disable users

Disable up to 100 users: they can no longer sign in, but their accounts and data are kept.

Inputs

Users (emails)usernameslistRequired: Up to 100 users' email addresses - one per entry, or separated by commas.

Outputs

disabled_userslist
errortext
requestedlist
statustext
unchanged_userslist

Example output

{
  "disabled_users": [
    "jane.doe@example.com"
  ],
  "error": null,
  "requested": [
    "jane.doe@example.com"
  ],
  "status": "success",
  "unchanged_users": []
}

Enable users

Re-activate disabled users so they can sign in again. Reports which were enabled and which already were.

Inputs

Users (emails)usernameslistRequired: The users' email addresses - one per entry, or separated by commas.

Outputs

enabled_userslist
errortext
requestedlist
statustext
unchanged_userslist

Example output

{
  "enabled_users": [
    "jane.doe@example.com"
  ],
  "error": null,
  "requested": [
    "jane.doe@example.com"
  ],
  "status": "success",
  "unchanged_users": []
}

Get password iterations

Get your account's default master password iteration count (the number of hashing rounds; 600,000 by default).

Inputs

None.

Outputs

iterationsnumber

Example output

{
  "iterations": 600000
}

Get user

Get one user by email address: their status, last sign-in, security score, item counts and groups.

Inputs

Username (email)usernametextRequired: The user's email address - their LastPass username. Use List users to find one.

Outputs

admintrue/false
applicationsnumber
attachmentsnumber
createdtext
disabledtrue/false
formfillsnumber
fullnametext
groupslist
idtext
last_logintext
last_pw_changetext
legacytotalscorenumber
linkedtext
mpstrengthnumber
neverloggedintrue/false
notesnumber
password_reset_requiredtrue/false
sitesnumber
totalscorenumber
usernametext

Example output

{
  "admin": false,
  "applications": 0,
  "attachments": 1,
  "created": "2026-03-12 10:02:56",
  "disabled": false,
  "formfills": 2,
  "fullname": "Jane Doe",
  "groups": [
    "Engineering"
  ],
  "id": "101",
  "last_login": "2026-10-01 08:14:03",
  "last_pw_change": "2026-03-12 10:05:12",
  "legacytotalscore": 55.1,
  "linked": null,
  "mpstrength": 100,
  "neverloggedin": false,
  "notes": 19,
  "password_reset_required": false,
  "sites": 72,
  "totalscore": 65.1,
  "username": "jane.doe@example.com"
}

List events

Read the audit log between two times, newest first: sign-ins, failed sign-ins, admin changes and vault activity, for every user or one.

Inputs

Fromstartdate and timeRequired: Events from this time, in the time zone of your account's oldest admin.
Toenddate and time: Events up to this time. Leave empty for now.
User (email)usernametext: Only this user's events. Leave empty for everyone.
Containssearchtext: Only events containing this text.
Admin events onlyadmin_onlytrue/false: Only events from admin actions.
Limitlimitnumber: Keep at most this many of the newest events. Default 100, at most 1000; narrow the time range for older ones.From 1 to 1000.
Next pagenext_pagetext: The next_page value from a previous call, when LastPass had more than 10,000 events in the range.

Outputs

countnumber
eventslist
fromtext
next_pagetext
returned_by_lastpassnumber
totext
truncatedtrue/false

Example output

{
  "count": 1,
  "events": [
    {
      "action": "Failed Login Attempt",
      "data": "",
      "ip_address": "203.0.113.21",
      "time": "2026-10-01 09:51:51",
      "username": "jane.doe@example.com"
    }
  ],
  "from": "2026-10-01 00:00:00",
  "next_page": null,
  "returned_by_lastpass": 1,
  "to": "2026-10-02 00:00:00",
  "truncated": false
}

List expired master passwords

List active users whose master password has expired under your password policy (federated users are not included).

Inputs

Limitlimitnumber: How many users to return, up to 500 (the default).From 1 to 500.
Continuation tokencontinuation_tokentext: The continuation_token from a previous call, to read the next users. Leave empty for the first.

Outputs

continuation_tokentext
countnumber
has_moretrue/false
remaining_countnumber
userslist

Example output

{
  "continuation_token": null,
  "count": 1,
  "has_more": false,
  "remaining_count": 0,
  "users": [
    {
      "last_pw_change": "2026-01-13 03:30:13",
      "user_id": 1234,
      "user_name": "jane.doe@example.com"
    }
  ]
}

List expiring master passwords

List users whose master password will expire within 7 days, to remind them before it does.

Inputs

Limitlimitnumber: How many users to return, up to 500 (the default).From 1 to 500.
Continuation tokencontinuation_tokentext: The continuation_token from a previous call, to read the next users. Leave empty for the first.

Outputs

continuation_tokentext
countnumber
has_moretrue/false
remaining_countnumber
userslist

Example output

{
  "continuation_token": null,
  "count": 1,
  "has_more": false,
  "remaining_count": 0,
  "users": [
    {
      "last_pw_change": "2026-01-20 03:30:13",
      "user_id": 1234,
      "user_name": "jane.doe@example.com"
    }
  ]
}

List shared folders

List every shared folder with its security score and the users it is shared with, including their permissions.

Inputs

None.

Outputs

countnumber
folderslist

Example output

{
  "count": 1,
  "folders": [
    {
      "id": "101",
      "name": "Shared-Engineering",
      "score": 99,
      "users": [
        {
          "can_administer": true,
          "give": true,
          "readonly": false,
          "username": "jane.doe@example.com"
        }
      ]
    }
  ]
}

List shared folders (detailed)

List shared folders as above, plus the sites each member can reach (LastPass returns these URLs encrypted). Optionally one page at a time.

Inputs

Page sizepage_sizenumber: How many folders to return on this page. Leave empty to return every folder.From 1 to 1000.
Pagepagenumber: Which page to return, starting at 1.At least 1.

Outputs

countnumber
folderslist
has_moretrue/false
pagenumber

Example output

{
  "count": 1,
  "folders": [
    {
      "id": "101",
      "name": "Shared-Engineering",
      "score": 99,
      "users": [
        {
          "can_administer": true,
          "give": true,
          "readonly": false,
          "sites": [
            "EncryptedURL1"
          ],
          "username": "jane.doe@example.com"
        }
      ]
    }
  ],
  "has_more": false,
  "page": null
}

List users

List a page of the users in your LastPass Business account, with their security scores, item counts and groups, optionally only enrolled or disabled users, or only admins.

Inputs

Account statusaccount_statustext: Which users to include.One of: any (Every user), enrolled (Only enrolled users), disabled (Only disabled users). Default: any.
Adminsadmin_filtertext: Include admins, non-admins or both.One of: any (Admins and non-admins), admins (Only admins), non_admins (Only non-admins). Default: any.
Page sizepage_sizenumber: How many users to return on this page. Default 100, at most 2,000.From 1 to 2000.
Pagepagenumber: Which page to return, starting at 1.At least 1.

Outputs

countnumber
groupslist
has_moretrue/false
pagenumber
page_sizenumber
totalnumber
userslist

Example output

{
  "count": 1,
  "groups": [
    {
      "members": [
        "jane.doe@example.com"
      ],
      "name": "Engineering"
    }
  ],
  "has_more": false,
  "page": 1,
  "page_size": 100,
  "total": 1,
  "users": [
    {
      "admin": false,
      "applications": 0,
      "attachments": 1,
      "created": "2026-03-12 10:02:56",
      "disabled": false,
      "formfills": 2,
      "fullname": "Jane Doe",
      "groups": [
        "Engineering"
      ],
      "id": "101",
      "last_login": "2026-10-01 08:14:03",
      "last_pw_change": "2026-03-12 10:05:12",
      "legacytotalscore": 55.1,
      "linked": null,
      "mpstrength": 100,
      "neverloggedin": false,
      "notes": 19,
      "password_reset_required": false,
      "sites": 72,
      "totalscore": 65.1,
      "username": "jane.doe@example.com"
    }
  ]
}

Log out user

End every LastPass session a user has open, on every device.

Inputs

Username (email)usernametextRequired: The user's email address - their LastPass username. Use List users to find one.

Outputs

statustext
usernametext

Example output

{
  "status": "OK",
  "username": "jane.doe@example.com"
}

Reinvite user

Send a user who has not yet joined their LastPass Business invitation again.

Inputs

Username (email)usernametextRequired: The user's email address - their LastPass username. Use List users to find one.

Outputs

statustext
usernametext

Example output

{
  "status": "OK",
  "username": "jane.doe@example.com"
}

Require master password change

Make a user change their master password the next time they sign in.

Inputs

Username (email)usernametextRequired: The user's email address - their LastPass username. Use List users to find one.

Outputs

statustext
usernametext

Example output

{
  "status": "OK",
  "username": "jane.doe@example.com"
}

Send password reset email

Email a user a link to reset their master password.

Inputs

Username (email)usernametextRequired: The user's email address - their LastPass username. Use List users to find one.

Outputs

statustext
usernametext

Example output

{
  "status": "OK",
  "username": "jane.doe@example.com"
}

Update user

Change a user's full name, Duo Security username or RSA SecurID username. Fields left empty are not changed.

Inputs

Username (email)usernametextRequired: The user's email address - their LastPass username. Use List users to find one.
Full namefull_nametext: The user's new full name.
Duo usernameduo_usernametext: The user's Duo Security username.
SecurID usernamesecurid_usernametext: The user's RSA SecurID username.

Outputs

duousernametext
fullnametext
securidusernametext
statustext
usernametext

Example output

{
  "fullname": "Jane A. Doe",
  "status": "OK",
  "username": "jane.doe@example.com"
}

Update user groups

Add a user to groups and remove them from others in one step.

Inputs

Username (email)usernametextRequired: The user's email address - their LastPass username. Use List users to find one.
Add to groupsadd_groupslist: Groups to add the user to. Pick existing ones or type a name.
Remove from groupsremove_groupslist: Groups to take the user out of.

Outputs

addedlist
removedlist
statustext
usernametext

Example output

{
  "added": [
    "Engineering"
  ],
  "removed": [],
  "status": "OK",
  "username": "jane.doe@example.com"
}

ActionsCopy Anchor Link

Add userCopy Anchor Link

Inputs

Outputs

Change user emailCopy Anchor Link

Inputs

Outputs

Delete userCopy Anchor Link

Inputs

Outputs

Disable multifactorCopy Anchor Link

Inputs

Outputs

Disable usersCopy Anchor Link

Inputs

Outputs

Enable usersCopy Anchor Link

Inputs

Outputs

Get password iterationsCopy Anchor Link

Inputs

Outputs

Get userCopy Anchor Link

Inputs

Outputs

List eventsCopy Anchor Link

Inputs

Outputs

List expired master passwordsCopy Anchor Link

Inputs

Outputs

List expiring master passwordsCopy Anchor Link

Inputs

Outputs

List shared foldersCopy Anchor Link

Inputs

Outputs

List shared folders (detailed)Copy Anchor Link

Inputs

Outputs

List usersCopy Anchor Link

Inputs

Outputs

Log out userCopy Anchor Link

Inputs

Outputs

Reinvite userCopy Anchor Link

Inputs

Outputs

Require master password changeCopy Anchor Link

Inputs

Outputs

Send password reset emailCopy Anchor Link

Inputs

Outputs

Update userCopy Anchor Link

Inputs

Outputs

Update user groupsCopy Anchor Link

Inputs

Outputs

On this page

Actions

Add user

Change user email

Delete user

Disable multifactor

Disable users

Enable users

Get password iterations

Get user

List events

List expired master passwords

List expiring master passwords

List shared folders

List shared folders (detailed)

List users

Log out user

Reinvite user

Require master password change

Send password reset email

Update user

Update user groups