Preview — pending review
This reference is generated from the platform API contract and is still under review. Operations, fields, and descriptions can change before publication.
Retrieve an IAM user's full detail record
Returns the complete IAM user read model that backs the user detail page and all of its tabs:
identity properties (email, title, department, manager, phone, employee id, directory source),
lifecycle status and account type, role assignments with their scope, group membership ids,
enrolled MFA devices, personal API keys (prefix and status only — never the secret), recent
activity rows. Live sessions are NOT embedded here — they are volatile and this
response is ETagged and cacheable, so they have their own read
(iam.user.sessions.list). Aggregates shown in the Access summary (role count,
distinct roles, subscription/project coverage) are derived client-side from this record.
Validation: scopeId must be a scope the caller can access and userId must identify a
user visible in that scope — unknown or out-of-scope ids return 404 via ErrNotFound.
Async & state: Synchronous read; no state change. The response carries an ETag so the UI can
issue conditional mutations (PATCH/DELETE with If-Match) against a known revision.
Errors: 401 when unauthenticated; 403 when the caller lacks an IAM-read-capable role on the
scope; 404 when scopeId or userId is unknown; 500 on read-model failure.
Idempotency/Concurrency: Safe, cacheable; no idempotency key required. Personal API key
secrets and MFA seed material are never present in this response — only the one-time create
responses reveal them.
bearerTokenAuthorizationBearer <token>An API token (pc_live_…) or a service-account key (sak_live_…), created in Identity & Access Management and sent as Authorization: Bearer <token>. Requests are rate limited per credential and per tenant: every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a refused request gets 429 RATE_LIMITED with Retry-After.
scopeId*stringOpaque ownership+authorization scope resolving to tenant + subscription + project.
userId*stringIdentifier of the IAM user.
The IAM user detail read model.
application/json- response
IAM user record (member, guest, or service account) as consumed by the Users page and the user detail page.
id*stringUser identifier.
name*stringFull display name.
email*stringCanonical email address (masked at the presentation layer, not by the API). The stored value as is — addresses are validated when written, never re-validated on read.
title*stringJob title.
avatarColor*stringDeterministic avatar color token used by the console.
status*stringThe MEMBERSHIP in this tenant. INACTIVE = a tenant admin suspended it: this tenant's scopes stop resolving for the person, while their memberships in other tenants keep working. Independent of operatorLocked.
"ACTIVE""INACTIVE""INVITED"operatorLocked*booleanWhether a platform operator has locked the person's sign-in globally. While true the user cannot sign in to any tenant whatever status says, and a tenant admin cannot lift it -- enabling the membership answers 409; only the platform operator unlocks. Independent of status.
type*stringAccount type.
"MEMBER""GUEST""SERVICE_ACCOUNT"mfaEnabled*booleanWhether the user has at least one enrolled MFA device.
lastLogin*|Last successful sign-in (ISO); null when the user has never signed in.
date-timeinvitedAt*|When the invitation was sent; null for users not created via invite.
date-timecreatedAt*stringCreation timestamp (ISO).
date-timelastPasswordChange*|Last successful password change (ISO); null for SSO-only users or never set.
date-timedepartment*stringOrganizational department.
manager*|Manager display name; null when unset.
phone*stringContact phone number.
employeeId*stringHR employee identifier.
groups*array<string>Ids of the groups the user belongs to.
mfaDevices*array<>Enrolled MFA devices.
apiKeys*array<>Personal API keys (prefix and status only; secrets are never present here).
roles*array<>Direct role assignments.
activity*array<>Recent activity rows for the Activity tab.
tags*array<>Custom governance key/value tags applied to the user via the Tags tab ("Add tag" -> iam.user.tag.create). Distinct from derived tags; drives access-review and cost-attribution dimensions.
accessSummary?What the member can reach in the tenant; present on list and invite answers.
curl -X GET "https://example.com/scopes/string/iam/users/string"{ "id": "string", "name": "string", "email": "string", "title": "string", "avatarColor": "string", "status": "ACTIVE", "operatorLocked": true, "type": "MEMBER", "mfaEnabled": true, "lastLogin": "2019-08-24T14:15:22Z", "invitedAt": "2019-08-24T14:15:22Z", "createdAt": "2019-08-24T14:15:22Z", "lastPasswordChange": "2019-08-24T14:15:22Z", "department": "string", "manager": "string", "phone": "string", "employeeId": "string", "groups": [ "string" ], "mfaDevices": [ { "id": "string", "kind": "TOTP", "name": "string", "addedAt": "2019-08-24T14:15:22Z", "lastUsedAt": "2019-08-24T14:15:22Z", "primary": true } ], "apiKeys": [ { "id": "string", "name": "string", "prefix": "string", "createdAt": "2019-08-24T14:15:22Z", "lastUsedAt": "2019-08-24T14:15:22Z", "status": "ACTIVE" } ], "roles": [ { "role": "owner", "roleId": "string", "roleName": "string", "scopeKind": "tenant", "scopeLabel": "string", "assignedAt": "2019-08-24T14:15:22Z" } ], "activity": [ { "id": "string", "at": "2019-08-24T14:15:22Z", "action": "string", "resource": "string", "status": "SUCCESS" } ], "tags": [ { "key": "string", "value": "string" } ], "accessSummary": { "kind": "tenant", "subscriptions": 0, "projects": 0 }}