---
title: "Get group"
method: GET
path: "/zones/{zoneId}/groups/{groupId}"
tags: ["Groups"]
---

# Get group

`GET /zones/{zoneId}/groups/{groupId}`

Returns a group by ID. Pass `expand[]=member_count` for its member count and `expand[]=roles` for the identifiers of its assigned roles.

## Path parameters

- `zoneId` string, required
- `groupId` string, required

## Query parameters

- `expand[]` union
  - 'member_count' | 'roles'
  - string[]

## Response `200`

A zone-scoped group of users, assignable to roles and usable in policies. Roles assigned to a group are inherited by its members. `external` is false for groups managed in Keycard and true for groups synced from an external directory.

- IamGroup — A zone-scoped group of users, assignable to roles and usable in policies. Roles assigned to a group are inherited by its members. `external` is false for groups managed in Keycard and true for groups synced from an external directory.
  - `id` string, required — Unique identifier of the group
  - `zone_id` string, required — Zone this group belongs to
  - `organization_id` string, required — Organization this group belongs to
  - `identifier` string, required — User-specified identifier, unique within the zone. Automatically assigned for groups from an external directory.
  - `name` string, required — Human-readable group name
  - `external` boolean, required — Whether the group is synced from an external directory. When true the group is directory-owned and its membership is read-only; when false it is managed in Keycard. Read-only: set by external sync, never by the caller.
  - `member_count` integer — Number of users in the group. Included only when requested via `expand[]=member_count` (group get or list).
  - `roles` string[] — Identifiers of the roles assigned to the group; members inherit them. Deduped across scopes. Included only when requested via `expand[]=roles` (group get or list).
  - `created_at` string, date-time, required — Entity creation timestamp
  - `updated_at` string, date-time, required — Entity update timestamp

## Other responses

- `404` — Error response
- `default` — Error response

## Changes

- **2026-08-26** `d65d51379d93` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/keycardai/apis/untitled-api/changes/zones/:zoneId/groups/:groupId/get.md)

---

[API](https://skmtc.dev/keycardai/apis/untitled-api.md) · [All operations](https://skmtc.dev/keycardai/apis/untitled-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/keycardai/untitled-api/revisions/d65d51379d93/schema)