# Get a directory user

`GET /v1/directories/{directory_id}/users/{directory_user_id}` · permission `directories:read`

Returns one live user record of the directory, with the same fields as [List directory users](list-users.md). Without the `users:read_pii` permission the personal data is masked the same way and `attributes` is `null`.

## Request

| Field | Type | Required | Description |
|---|---|---|---|
| `directory_id` | path | yes | SCIM directory ID (`dir_…`). |
| `directory_user_id` | path | yes | Directory user ID (`dsu_…`). |

There is no request body.

## Response

`200 OK` with the directory user.

```json
{
  "id": "dsu_01j9xp4q6r8s0t2v4w6x8y0z2b",
  "directory_id": "dir_01j9xm2n4p6q8r0s2t4v6w8y0z",
  "external_id": "00u1a2b3c4",
  "user_name": "j***",
  "emails": [{ "value": "j***@e***.com", "primary": true }],
  "given_name": "J.",
  "family_name": "D.",
  "display_name": "J. D.",
  "locale": "en-US",
  "zoneinfo": "Europe/Berlin",
  "state": "inactive",
  "attributes": null,
  "groups": [],
  "user_id": null,
  "link_status": "unlinked",
  "drift": false,
  "created_at": "2026-10-20T09:00:00Z",
  "updated_at": "2026-10-20T09:05:00Z"
}
```

The example shows a response to a credential without `users:read_pii`.

## Errors

| HTTP | code | When |
|---|---|---|
| 404 | `not_found` | The directory or the user record does not exist in this environment, belongs to another directory, or has been deleted. |
| 401 | `unauthenticated` | The credential is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The credential lacks the required permission. |
| 429 | `rate_limited` | The rate limit was exceeded; retry after the `Retry-After` period. |
| 503 | `service_unavailable` | Directory sync is temporarily unavailable or not configured in this deployment; retry after the `Retry-After` period. |

## Example

```bash
curl -i "https://api.eu.keenauth.com/v1/directories/dir_01j9xm2n4p6q8r0s2t4v6w8y0z/users/dsu_01j9xp4q6r8s0t2v4w6x8y0z2b" \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
```

## Personal data

This endpoint carries personal data: directory (SCIM) users. [Personal data in the KeenAuth APIs](/docs/policies/personal-data) describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.