I am trying to use the API to list my organization members, but I do not understand the difference between lastActive and lastLogin.

The lastActive field is updated in the database when a user performs certain actions, not just when they log in. The main place this happens is in the audit log. This means any action that triggers an audit log event and records a user IP (such as API requests, UI actions, or other authenticated requests) can update lastActive.

The lastLogin field on the other hand is only updated when the user successfully logs in.