Sign in
Users

Get user

Returns details of a specific user by user ID. Use expand[]=role-assignments for the user's structured role grants and expand[]=groups for the user's group memberships. Role grants are direct only by default, each tagged with source; use role_source=all to also include group-inherited.

get/zones/{zoneId}/users/{id}

Path parameters

zoneIdstring required

Zone ID

idstring required

User ID

Query parameters

'role-assignments' | 'groups'
OR
string[]
role_source'user' | 'group' | 'all'

Selects which grants expand[]=role-assignments returns, tagging each with source: user (direct only, the default), group (group-inherited only), or all (both direct and group-inherited). Requires expand[]=role-assignments.

Response

An authenticated user entity

idstring required

Unique identifier of the user

organization_idstring required

Organization that owns this user

zone_idstring required

Zone this user belongs to

identifierstring required

Zone-scoped user identifier. Defaults to the user's Keycard ID. When the provider has user_identifier_claim configured, the value is set from that claim at user creation time.

subjectstring

Subject identifier from the identity provider

issuerstring

Issuer identifier of the identity provider

emailstring email required

Email address of the user

email_verifiedboolean required

Whether the email address has been verified

status'active' | 'disabled' required

Status of the user. Disabled users cannot authenticate.

provider_idstring

Reference to the identity provider. This field is undefined when the source identity provider is deleted but the user is not deleted.

created_atstring date-time required

Entity creation timestamp

updated_atstring date-time required

Entity update timestamp

authenticated_atstring

Date when the user was last authenticated

session_countinteger

Session count for this user. Populated only when expand[]=session_count is set on the listing endpoint.

grant_countinteger

Delegated-grant count for this user. Populated only when expand[]=grant_count is set on the listing endpoint.

Changes