---
title: "GET /staff/users/{user_uuid}"
method: GET
path: "/staff/users/{user_uuid}"
tags: ["Staff"]
---

# GET /staff/users/{user_uuid}

`GET /staff/users/{user_uuid}`

## Request

- Base URL: `https://api.laver.app` (the document declares no server; this is the origin it was published from)
- URL: `https://api.laver.app/staff/users/{user_uuid}`
- Auth: HTTP bearer

## Path parameters

- `user_uuid` string, uuid, required

## Response `200`

Success. The properties described here are the ones the response schema enforces; the body also carries fields it does not yet declare.

- object
  - `user` object, nullable
    - `uuid` string, nullable
    - `first_name` string, nullable
    - `last_name` string, nullable
    - `email` string, nullable
    - `profile_image_url` string, nullable
    - `verified` boolean, nullable
    - `totp_enabled` boolean, nullable
    - `phone_number_verified` boolean, nullable
    - `attempts` integer, nullable
    - `timeout_until` string, nullable
    - `max_timeout` boolean, nullable
    - `is_locked_out` boolean, nullable
    - `last_attempted_at` string, nullable
    - `created_at` string, nullable
    - `updated_at` string, nullable
    - `deleted_at` string, nullable
    - `purged_at` string, nullable
    - `terms_accepted_at` string, nullable
    - `terms_version` string, nullable
    - `staff_role` string, nullable
    - `staff_access` object, nullable
      - `role` string, nullable
      - `is_active` boolean, nullable
      - `expires_at` string, nullable
      - `is_live` boolean, nullable
    - `membership_count` integer, nullable
    - `active_membership_count` integer, nullable
    - `owned_workspace_count` integer, nullable
    - `active_api_key_count` integer, nullable
    - `last_activity_at` string, nullable
    - `activity_bucket` string, nullable
    - `workspaces` object[], nullable
      - `workspace_uuid` string, nullable
      - `name` string, nullable
      - `slug` string, nullable
      - `role` string, nullable
      - `is_active` boolean, nullable
      - `member_since` string, nullable
      - `plan` string, nullable
      - `billing_status` string, nullable
      - `seats` integer, nullable
      - `is_comped` boolean, nullable
      - `archived_at` string, nullable
      - `suspended_at` string, nullable
      - `closure_scheduled_at` string, nullable
  - `platform_audit` object[], nullable
    - `actor` object, nullable
      - `uuid` string, nullable
      - `name` string, nullable

## Other responses

- `400`: The request failed schema validation, or the handler rejected its contents. Undeclared properties are rejected on every body, path and query schema, so an unexpected field is a 400 rather than a silently ignored one.
- `401`: No credential, or one that is expired, revoked or not accepted by this endpoint.
- `403`: Authenticated, but not allowed: a `viewer` attempting a write, a `commenter` attempting any write other than a comment on a ticket it can see, a `guest` writing anywhere or a `guest_editor` writing outside the boards it was given, a non-admin on an admin route, a non-owner on billing, or a non-staff user on staff tooling.
- `404`: No such resource — or one the caller may not see. Membership and board access are enforced by answering 404 rather than 403, so a stranger never learns that a resource exists.
- `429`: The rate limit was exceeded. The budget is keyed on the authenticated session user or API key, falling back to the caller IP.

---

[API](https://skmtc.dev/laver/apis/laver-api.md) · [All operations](https://skmtc.dev/laver/apis/laver-api/llms.txt) · [OpenAPI document](https://skmtc.dev/laver/apis/laver-api/revisions/91e3db25a19c?raw)