KEkeycardai
Users

Get user

Changed on

Returns details of a specific user by user ID. Use expand[]=role-assignments for the user's structured role grants and expand[]=groups for the user's group memberships. Role grants are direct only by default, each tagged with source; use role_source=all to also include group-inherited.

get/zones/{zoneId}/users/{id}

Request

  • Base URL
    https://docs.keycard.ai (the document declares no server; this is the origin it was published from)
  • URL
    https://docs.keycard.ai/zones/{zoneId}/users/{id}
  • Auth
    • HTTP bearer
    • or OAuth 2
      Client credentials
      Token URL: /service-account-token

Path parameters

zoneIdstring required

Zone ID

idstring required

User ID

Query parameters

'role-assignments' | 'groups'
OR
string[]
role_source'user' | 'group' | 'all'

Selects which grants expand[]=role-assignments returns, tagging each with source: user (direct only, the default), group (group-inherited only), or all (both direct and group-inherited). Requires expand[]=role-assignments.

Response

An authenticated user entity

idstring required

Unique identifier of the user

organization_idstring required

Organization that owns this user

zone_idstring required

Zone this user belongs to

identifierstring required

Zone-scoped user identifier. Defaults to the user's Keycard ID. When the provider has user_identifier_claim configured, the value is set from that claim at user creation time.

subjectstring

Subject identifier from the identity provider

issuerstring

Issuer identifier of the identity provider

emailstring email required

Email address of the user

email_verifiedboolean required

Whether the email address has been verified

status'active' | 'disabled' required

Status of the user. Disabled users cannot authenticate.

externalboolean required

Whether the user is synced from an external directory over SCIM. When true the user is directory-owned: status cannot be changed and the user cannot be deleted through this API while the zone has external_sync_enabled set.

provider_idstring

Reference to the identity provider. This field is undefined when the source identity provider is deleted but the user is not deleted.

created_atstring date-time required

Entity creation timestamp

updated_atstring date-time required

Entity update timestamp

authenticated_atstring

Date when the user was last authenticated

session_countinteger

Session count for this user. Populated only when expand[]=session_count is set on the listing endpoint.

grant_countinteger

Delegated-grant count for this user. Populated only when expand[]=grant_count is set on the listing endpoint.

Changes

  • 0cfaff865771Revision changes
    • warning

      removed the optional property //////// from the response with the status

    • info

      added the required property to the response with the status

    • info

      added the required property // to the response with the status

    • info

      added the required property // to the response with the status

  • d65d51379d93Revision changes
    • info

      added the new optional query request parameter expand[]

    • info

      added the new optional query request parameter role_source

    • info

      added the non-success response with the status

    • info

      added the non-success response with the status

    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status

    • info

      added the optional property // to the response with the status

    • info

      the // response's property pattern ^[a-z0-9]+(?:[-_][a-z0-9]+)*$ was added for the status

    • info

      added the required property // to the response with the status

    • info

      added the required property // to the response with the status