Get a directory user

GET /v1/directories/{directory_id}/users/{directory_user_id} · permission directories:read

Returns one live user record of the directory, with the same fields as List directory users. Without the users:read_pii permission the personal data is masked the same way and attributes is null.

Request

Field	Type	Required	Description
`directory_id`	path	yes	SCIM directory ID (`dir_…`).
`directory_user_id`	path	yes	Directory user ID (`dsu_…`).

There is no request body.

Response

200 OK with the directory user.

{
  "id": "dsu_01j9xp4q6r8s0t2v4w6x8y0z2b",
  "directory_id": "dir_01j9xm2n4p6q8r0s2t4v6w8y0z",
  "external_id": "00u1a2b3c4",
  "user_name": "j***",
  "emails": [{ "value": "j***@e***.com", "primary": true }],
  "given_name": "J.",
  "family_name": "D.",
  "display_name": "J. D.",
  "locale": "en-US",
  "zoneinfo": "Europe/Berlin",
  "state": "inactive",
  "attributes": null,
  "groups": [],
  "user_id": null,
  "link_status": "unlinked",
  "drift": false,
  "created_at": "2026-10-20T09:00:00Z",
  "updated_at": "2026-10-20T09:05:00Z"
}

The example shows a response to a credential without users:read_pii.

Errors

HTTP	code	When
404	`not_found`	The directory or the user record does not exist in this environment, belongs to another directory, or has been deleted.
401	`unauthenticated`	The credential is missing, invalid or revoked.
403	`insufficient_permissions`	The credential lacks the required permission.
429	`rate_limited`	The rate limit was exceeded; retry after the `Retry-After` period.
503	`service_unavailable`	Directory sync is temporarily unavailable or not configured in this deployment; retry after the `Retry-After` period.

Example

curl -i "https://api.eu.keenauth.com/v1/directories/dir_01j9xm2n4p6q8r0s2t4v6w8y0z/users/dsu_01j9xp4q6r8s0t2v4w6x8y0z2b" \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"

Personal data

This endpoint carries personal data: directory (SCIM) users. Personal data in the KeenAuth APIs describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.