---
title: "Privy identity state for an account"
method: GET
path: "/admin/users/{account_id}/identity"
tags: ["admin"]
---

# Privy identity state for an account

`GET /admin/users/{account_id}/identity`

## Request

- Base URL: `https://api.instruxi.dev/api/v1/enforcer`
- URL: `https://api.instruxi.dev/api/v1/enforcer/admin/users/{account_id}/identity`
- Auth: one of:
  - API key in header `Authorization`
  - API key in header `X-API-Key`

Live identity-provider state for one account beside enforcer's own row: the account's stored email/phone and their verified flags, the VERIFIED contacts Privy holds right now, whether they still agree, and the live passkey MFA posture. email_matches_account is the field to read first — a Privy-linked address that has drifted from accounts.email sends every login code to an inbox the user no longer reads, and nothing else in the database exposes that. Both match fields are null (never false) when either side is blank, since "Privy holds no email" is a different problem from "the emails disagree"; both values ship in the body so a null always explains itself. privy is null for an account with no Privy user (native/SSO tenants), which is a fact about the tenant, not a fault. A Privy read that fails refuses the whole response rather than serving it with the provider half silently missing.

## Path parameters

- `account_id` string, required

## Query parameters

- `tenant_id` string

## Response `200`

OK

- InternalDeliveryHttpHandlerAdminIdentityResponse
  - `data` InternalDeliveryHttpHandlerAdminIdentityData
    - `account_email` string
    - `account_email_verified` boolean
    - `account_id` string
    - `account_phone` string: AccountPhone is persons.primary_phone — accounts carry no phone column.
    - `account_phone_verified` boolean
    - `auth_provider` string: AuthProvider is the tenant's effective provider and the context for every null below — a native or enterprise tenant has no Privy side at all.
    - `email_matches_account` boolean: EmailMatchesAccount is the field to read first. A Privy-linked address that has drifted from accounts.email sends every login code to an inbox the user no longer reads, and nothing else in the database exposes it. null — never false — when either side is blank: "Privy holds no email" is a different problem from "the emails disagree", and both values are in this body, so a null always explains itself.
    - `last_login_at` string: LastLoginAt is EMPTY for every Privy-token user by construction, not by accident. It ships anyway: seeing the blank next to a healthy Privy posture is what stops the next reader taking it for "never logged in".
    - `passkey_mfa` InternalDeliveryHttpHandlerPasskeyMfaStatusData
      - `account_id` string
      - `credentials` integer
      - `factor_advertised` boolean
      - `methods` string[]
      - `needs_stamp` boolean: NeedsStamp: enrolled on Privy, never stamped here — safe to backfill.
      - `passkeys` InternalDeliveryHttpHandlerPasskeyMfaCredentialData[]
        - `authenticator_name` string
        - `created_with_browser` string
        - `created_with_device` string
        - `created_with_os` string
        - `credential_id` string
        - `enrolled_in_mfa` boolean
        - `first_verified_at` string
        - `latest_verified_at` string
      - `privy_user_id` string
      - `stamp_diverged` boolean: StampDiverged: stamped, but Privy no longer reports a backed enrollment.
      - `state` string
      - `tenant_id` string
      - `verified_at` string
    - `phone_matches_account` boolean: PhoneMatchesAccount is the same comparison for the number, both sides canonicalized so formatting is never reported as drift.
    - `privy` InternalDeliveryHttpHandlerAdminIdentityPrivyData
      - `email` string
      - `phone` string
    - `privy_user_id` string
    - `tenant_id` string
  - `success` boolean

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `502`: Bad Gateway
- `503`: Service Unavailable

---

[API](https://skmtc.dev/instruxi/apis/enforcer-api.md) · [All operations](https://skmtc.dev/instruxi/apis/enforcer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/instruxi/apis/enforcer-api/revisions/fa82bc1becc0?raw)