---
title: Get users by AD group
summary: Retrieves AD group membership, optionally recursively, through the remote SecurityApi.
status: draft
owner: Framework.NCore maintainers
last_reviewed: 2026-10-02
library: SAIF.NetCore.AuthService
reference_type: package
operation_id: OP-06
trigger: Caller code requests the membership of an AD group.
---

# Get users by AD group

Retrieves AD group membership, optionally recursively, through the remote SecurityApi.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-06 |
| **Trigger** | Caller code requests the membership of an AD group. |
| **Inputs** | `groupName`, `domain`, `recurse`. |
| **Outputs** | Collection of users in the group, or a thrown `SecurityClientException`. |
| **Primary components** | `SecurityClient.GetUsersByGroup(groupName, domain, recurse)` |
| **Entry point** | `src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Clients/SecurityClient.cs` |

## Steps

1. `GET /v1/Users/GetUsersByGroup/{domain}/{groupName}?recurse={recurse}` through `HandleSecurityServiceGetResponse<string[]>` ([BR-AUTH-011](../business-rules.md#br-auth-011-a-non-successful-securityapi-response-always-throws))
   - 1.1 Await the GET call.
   - 1.2 On success, return `result.GetResult<string[]>()`.
   - 1.3 Otherwise, if `result.ErrorException` is present, throw `SecurityClientException(result.ErrorMessage, result.ErrorException)` (error with inner exception).
   - 1.4 Otherwise (no inner exception), throw `SecurityClientException(result.ErrorMessage)`.

   > **Origin**: Steps 1.1–1.4 are implemented in [Handle a Security API response](handle-a-security-api-response.md) (`SAIF.NetCore.AuthService`) and executed on behalf of this operation.

## Process flow

The following diagram visualizes this operation's control flow.

```mermaid
flowchart TD
    Start([GetUsersByGroup called]) --> Get["GET /v1/Users/GetUsersByGroup/domain/groupName?recurse"]
    Get --> Success{IsSuccessful?}
    Success -->|Yes| Return([Return user collection])
    Success -->|No| Throw([Throw SecurityClientException])
```

## Failure and edge-case behavior

- A non-success remote response throws `SecurityClientException`.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)

## Sources
- `src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Clients/SecurityClient.cs`