---
title: "Get a single organization user"
method: GET
path: "/api/{org_id}/users/{email_id}"
tags: ["Users"]
---

# Get a single organization user

`GET /api/{org_id}/users/{email_id}`

## Request

- Base URL: `https://api.openobserve.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.openobserve.ai/api/{org_id}/users/{email_id}`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/openobserve/apis/openobserve-api-http/docs/api/:org_id/users/:email_id/get.ts> (a function with typed inputs; its response is checked against the schema)

Returns one member of the organization — the same record the list endpoint reports — together with their failed-login lockout state: whether they are currently locked out of password authentication, how long is left on the lock, and the failure counters behind it. Requires Root or Admin on the named organization, and the user must belong to it. A user who has never failed a login is reported as unlocked with zeroed counters rather than as missing.

## Path parameters

- `org_id` string, required
- `email_id` string, required

## Response `200`

Success

- UserDetailsResponse: One organization member, as the list endpoint reports them, plus their lockout state. The counters are an administrator's view and must not be handed to the user they describe: someone who can read the escalation level and the remaining seconds can derive the thresholds behind them and pace attempts to stay underneath.
  - `created_at` integer, required
  - `description` string, nullable: Human-readable description of what this account is used for.
  - `email` string, required
  - `first_name` string
  - `is_external` boolean
  - `is_system` boolean: True when this account is a system-managed service account. The UI should display "System Managed" for the role instead of the raw role string.
  - `last_name` string
  - `orgs` OrgRoleMapping[], nullable
    - `org_id` string, required
    - `org_name` string, required
    - `role` 'root' | 'admin' | 'editor' | 'viewer' | 'user' | 'service_account' | 'sre_agent', required
  - `role` string, required
  - `token` string, nullable
  - `lockout` LockoutState, required: A user's lockout state as an administrator sees it. The counters and the escalation level are included because the reader is an authenticated instance admin. They must not be handed to the user they describe: someone who can read the level and the remaining seconds can derive the thresholds behind them and pace attempts to stay underneath.
    - `email` string, required
    - `failed_attempts` integer, required
    - `last_failed_at` integer, nullable
    - `locked` boolean, required
    - `locked_until` integer, nullable
    - `lockout_level` integer, required: How many lockouts this account has served. Kept after a lock expires, because it is what makes the next one longer.
    - `retry_after_secs` integer, nullable: Seconds until the account may try again, present only while the lock holds.

## Other responses

- `403`: Forbidden
- `404`: Not Found

---

[API](https://skmtc.dev/openobserve/apis/openobserve-api-http.md) - [All operations](https://skmtc.dev/openobserve/apis/openobserve-api-http/llms.txt) - [OpenAPI document](https://skmtc.dev/openobserve/apis/openobserve-api-http/revisions/0529b8a10252?raw)