---
title: "UserInfo endpoint"
method: GET
path: "/userinfo"
tags: ["Identity Provider"]
---

# UserInfo endpoint

`GET /userinfo`

## Request

- Base URL: `https://id.deadsimple.email`
- URL: `https://id.deadsimple.email/userinfo`
- Auth: none required

Send `Authorization: Bearer dse_idt_...`. Returns the claims for the granted scopes. This is the only place `owner_email` is served, and only to registered clients that were granted the owner_email scope.

## Response `200`

Claims for the agent inbox.

- IdentityClaims: Claims in the id_token and from /userinfo. Which ones appear depends on the granted scopes and on whether the client is registered.
  - `sub` string: The inbox_id. Stable for the life of the inbox; use it as the user id.
  - `inbox_id` string
  - `agent` boolean: Always true.
  - `owner_verified` boolean: True when a verified human owns the account behind the inbox; false for unclaimed agent-signup (trial) accounts.
  - `email` string: The inbox address (scope email).
  - `email_verified` boolean: Always true (scope email).
  - `name` string: Inbox display name, falling back to the local part (scope profile).
  - `preferred_username` string: Local part of the inbox address (scope profile).
  - `org` string: Account id that owns the inbox (scope org, registered clients).
  - `plan` 'trial' | 'free' | 'hobby' | 'pro' | 'scale' | 'enterprise': Account plan (scope org, registered clients).
  - `owner_email` string, nullable: Verified owner email (scope owner_email, registered clients). Returned from /userinfo only, never inside the id_token. Null when owner_verified is false.

## Other responses

- `401`: invalid_token, with a WWW-Authenticate Bearer challenge.

---

[API](https://skmtc.dev/deadsimple/apis/dead-simple-email-api.md) · [All operations](https://skmtc.dev/deadsimple/apis/dead-simple-email-api/llms.txt) · [OpenAPI document](https://skmtc.dev/deadsimple/apis/dead-simple-email-api/revisions/c697881be131?raw)