diff --git a/apps/api/src/routes/auth.ts b/apps/api/src/routes/auth.ts
index 3d5eb30..469b401 100644
--- a/apps/api/src/routes/auth.ts
+++ b/apps/api/src/routes/auth.ts
@@ -13,6 +13,7 @@ import {
   getAppSwitcherConfig,
   getUserByEmail,
   getUserById,
+  listUsers,
   revokeRefreshSession,
 } from '@authportal/db'
 import { requireAuth } from '../plugins/auth-guards.js'
@@ -125,6 +126,32 @@ export async function authRoutes(app: FastifyInstance): Promise<void> {
     },
   )
 
+  app.get(
+    '/api/v1/directory/users',
+    { onRequest: requireAuth },
+    async (request) => {
+      const q = String(
+        (request.query as { q?: string }).q ?? '',
+      )
+        .trim()
+        .toLowerCase()
+      const all = listUsers(app.db).filter((u) => !u.disabled)
+      const filtered = q
+        ? all.filter(
+            (u) =>
+              u.email.toLowerCase().includes(q) ||
+              u.name.toLowerCase().includes(q) ||
+              u.id.toLowerCase().includes(q),
+          )
+        : all
+      return filtered.slice(0, 50).map((u) => ({
+        id: u.id,
+        email: u.email,
+        name: u.name,
+      }))
+    },
+  )
+
   app.get(
     '/api/v1/catalog',
     { onRequest: requireAuth },