---
title: "GET /v1/oidc/userinfo"
method: GET
path: "/v1/oidc/userinfo"
tags: ["oidc"]
---

# GET /v1/oidc/userinfo

`GET /v1/oidc/userinfo`

Fetches the current UserInfo claims for the authorized user. This is the same fields
returned by a id_token returns during authorization.

The claims returned depend on the granted scopes: `profile` claims (`name`, `given_name`,
`family_name`) are only returned when the `profile` scope is granted, and `email` claims
(`email`, `email_verified`) are only returned when the `email` scope is granted. The
`openid` scope is always required.

## Response `200`

OK

- UserInfoResponse
  - `sub` string, required — Identifier for the End-User at the Issuer.
  - `name` string — End-User's full name in displayable form including all name parts, possibly including titles and suffixes, ordered according to the End-User's locale and preferences.
  - `given_name` string — Given name(s) or first name(s) of the End-User. Note that in some cultures, people can have multiple given names; all can be present, with the names being separated by space characters.
  - `family_name` string — Surname(s) or last name(s) of the End-User. Note that in some cultures, people can have multiple family names or no family name; all can be present, with the names being separated by space characters.
  - `email` string, email — End-User's preferred e-mail address. Its value MUST conform to the RFC 5322 [RFC5322] addr-spec syntax. The RP MUST NOT rely upon this value being unique, as discussed in Section 5.7.
  - `email_verified` boolean — True if the End-User's e-mail address has been verified; otherwise false. When this Claim Value is true, this means that the OP took affirmative steps to ensure that this e-mail address was controlled by the End-User at the time the verification was performed. The means by which an e-mail address is verified is context specific, and dependent upon the trust framework or contractual agreements within which the parties are operating.

## Other responses

- `401` — Unauthorized
- `default` — Error Response

## Changes

- **2026-08-28** `f32aa6ee029d` — 2 warning, 1 info
  - added the new `design_generation_rejected` enum value to the `code` response property for the response status `401`
  - added the new `design_generation_rejected` enum value to the `code` response property for the response status `default`
  - the security scope `profile` was added to the endpoint's security scheme `oauthAuthCode`
- **2026-08-27** `e5ffb199a510` — 4 warning, 1 info
  - added the new `domain_restricted` enum value to the `code` response property for the response status `401`
  - added the new `domain_restricted` enum value to the `code` response property for the response status `default`
  - added the new `user_already_member` enum value to the `code` response property for the response status `401`
  - added the new `user_already_member` enum value to the `code` response property for the response status `default`
  - …1 more
- **2026-08-17** `360bf0176ab2` — 1 info
  - the security scope `profile` was added to the endpoint's security scheme `oauthAuthCode`
- **2026-08-14** `96535efdbde5` — 1 info
  - the security scope `profile` was added to the endpoint's security scheme `oauthAuthCode`
- **2026-08-13** `da734432d73d` — 1 info
  - the security scope `profile` was added to the endpoint's security scheme `oauthAuthCode`

[Full history](https://skmtc.dev/canva/apis/canva-connect-api/changes/v1/oidc/userinfo/get.md)

---

[API](https://skmtc.dev/canva/apis/canva-connect-api.md) · [All operations](https://skmtc.dev/canva/apis/canva-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/canva/canva-connect-api/revisions/f32aa6ee029d/schema)