---
title: "Get IAM principal"
method: GET
path: "/v3/iam/principals/{principal_id}"
tags: ["IAM principals"]
---

# Get IAM principal

`GET /v3/iam/principals/{principal_id}`

## Request

- Base URL: `https://api.us.nylas.com`
- URL: `https://api.us.nylas.com/v3/iam/principals/{principal_id}`
- Auth: HTTP bearer

Requires `iam.principals.read` on an active principal bound to the authenticated organization. Authenticate with an active, unexpired IAM credential of type `api_key`. Application API keys (including legacy API keys) and provider OAuth tokens cannot authorize IAM management endpoints. Use an existing IAM credential with these permissions, or [create your first management credential in the Dashboard](/docs/v3/auth/nylas-iam/manage-principals-with-api/#create-a-management-credential-in-the-dashboard).

## Response `200`

OK

- object
  - `request_id` string: Request ID for troubleshooting.
  - `data` Principal
    - `id` string, required: Opaque principal ID.
    - `organization_id` string, required: Organization inferred from the authenticating IAM API key.
    - `name` string, required: Descriptive workload name. Surrounding whitespace is removed.
    - `description` string, required: Optional workload description.
    - `status` 'active' | 'disabled', required: Whether the principal or credential can authenticate.
    - `roles` string[], required: System or custom role IDs. Duplicate IDs are removed. Use the Dashboard to manage custom roles. Accepts up to 100 distinct IDs. Accepts up to 100 distinct IDs.
    - `direct_permissions` string[], required: Canonical permission IDs assigned directly to the principal. Duplicate IDs are removed. Accepts up to 100 distinct IDs. Accepts up to 100 distinct IDs.
    - `resource_binding` ResourceBinding, required
      - `type` 'organization' | 'application' | 'workspace' | 'grant', required: Resource boundary for this principal.
      - `id` string, required: ID of a resource in the authenticated organization.
    - `created_at` integer, required: Unix timestamp in seconds.
    - `updated_at` integer, required: Unix timestamp in seconds.

## Other responses

- `400`: Invalid request or object quota exceeded
- `401`: Invalid, disabled, deleted, or expired authentication credential
- `403`: Missing management permission or organization binding
- `404`: Principal or credential not found in this organization
- `409`: Conflicting principal or credential state
- `429`: Too many requests

## Changes

- **2026-10-10** `fb580f0d35d2`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/nylas/apis/nylas-api/changes/v3/iam/principals/:principal_id/get.md)

---

[API](https://skmtc.dev/nylas/apis/nylas-api.md) - [All operations](https://skmtc.dev/nylas/apis/nylas-api/llms.txt) - [OpenAPI document](https://skmtc.dev/nylas/apis/nylas-api/revisions/7782a3e3ab70?raw)