## Overview
cgi-bin/user/list returns full member profiles of a department (including sensitive fields like mobile and email) and is the standard endpoint for organization master-data sync. Important: it requires the token issued from the Contact Sync assistant's secret, not a normal self-built app secret — self-built apps only get restricted fields.
### Request essentials
1. POST with Content-Type: application/json; the contact-secret access_token goes in the URL query.
2. Body: department_id (required; root is 1) and fetch_child (1 to recurse into sub-departments, 0 for the current level only).
3. The userlist array carries userid, name, department ids, position, mobile, email and status (1 activated, 4 not activated).
4. Full sync typically walks cgi-bin/department/list for the tree first, then lists members per department; enabling contact callbacks delivers member-change events in real time and replaces polling.
### Master-data advice
- Join on userid (unique within the enterprise); never on names, which collide.
- Resigned members disappear from the API — flag them inactive on the master-data side rather than deleting, preserving historical document ownership.
- mobile/email are sensitive: guard the contact secret tightly and evaluate field necessity before propagating to downstream systems, minimizing the sensitive-data footprint.
### Choosing the lighter variant
If you only need userid and name, prefer the simplelist endpoints — smaller payloads and lower privilege requirements. Use user/list only when mobile, email or position fields are genuinely required. Following data-minimization here also shrinks the blast radius if the contact-sync secret ever leaks.