Get a member's diagnostics

GET /v1/organizations/{org_id}/memberships/{membership_id}/diagnostics · permissions organizations:read and users:read

Answers "why can't this member sign in?" for an organization admin in one response: the membership, a summary of the organization's policies, a pending invitation, a summary of the member's authenticators, the sign-in state in the context of the organization, the member's directory groups and the member's access to applications. It is read only: nothing changes, and write actions go to their own endpoints. Sign-in activity is read with List a user's logs and org_id.

Only data that belongs to the organization is returned. Labels, AAGUIDs, IP addresses, user agents, email addresses, CIDR ranges and records from the context of another organization are never part of the response.

Request

Field Type Required Description
org_id path yes Organization ID (org_…).
membership_id path yes Membership ID (mem_…).

No request body.

Response

200 OK with these fields:

Field Description
membership The membership as Get a membership returns it: status, source, roles and the suspension reason.
policy The policies written on the organization: authentication_methods (passkey and password allowed, number of allowed connections), mfa (who must use MFA and the allowed factors), phishing_resistant, sso_enforcement (mode, and bypass when the member is on the break-glass list) and ip_allowlist (present, and who it applies to). null means the organization inherits the environment value for that policy.
invitation Only for an invited membership: the pending invitation to the user's primary email address, with its delivery and delivery status. null otherwise. The email address is not returned.
authenticators classes: the types of the member's active authenticators. mfa_enrolled: true when an active authenticator has the role second_factor or both.
sign_in locked and locked_until (a lock stops the account's sign-in in every context), and the last sign-in in the context of this organization (last_sign_in_at, last_sign_in_amr). Failure counters are not shown, because they belong to no organization.
groups The member's groups in the organization's directories (data: id dsg_… and directory_id dir_…; at most 100, truncated when there are more). Only memberships of a directory user that is linked to this user and active count. Group names are not returned; read them with GET /v1/directories/{directory_id}/groups/{directory_group_id}.
applications Access to applications in this organization. Applications whose org_access_mode is all_organizations are open to every member and only counted (open_count). For the other applications (data, by name, at most 100, truncated when there are more): application_id, name, access_mode, allowed, and reason when access is refused (application_not_enabled: the application is not enabled for the organization; application_not_assigned: neither the membership nor one of its directory groups is assigned). The decision follows the same rule as the check at sign-in. 
{
  "membership": {
    "id": "mem_01j9xn5p9s0t4v6w8x0y2z4a6c",
    "organization_id": "org_01j9xk3m7q8r2s4t6v8w0y2z4a",
    "user_id": "usr_01j9xh2k6p7q1r3s5t7v9w1x3y",
    "status": "suspended",
    "source": "scim",
    "reason": "scim_deprovisioned",
    "roles": [],
    "expires_at": null,
    "created_at": "2026-10-12T09:31:00.123456Z",
    "activated_at": "2026-10-12T09:31:00.123456Z",
    "suspended_at": "2026-10-20T07:00:00Z",
    "removed_at": null,
    "updated_at": "2026-10-20T07:00:00Z",
    "version": 3
  },
  "policy": {
    "authentication_methods": null,
    "mfa": { "required_for": "all", "allowed_factors": ["totp", "webauthn"] },
    "phishing_resistant": null,
    "sso_enforcement": { "mode": "org_context", "bypass": false },
    "ip_allowlist": null
  },
  "invitation": null,
  "authenticators": { "mfa_enrolled": false, "classes": ["webauthn"] },
  "sign_in": {
    "locked": false,
    "locked_until": null,
    "last_sign_in_at": "2026-10-19T08:15:42Z",
    "last_sign_in_amr": ["fed"]
  },
  "groups": {
    "data": [{ "id": "dsg_01j9xp4r8s2t4v6w8x0y2z4a6b", "directory_id": "dir_01j9xm1n5p7q9r1s3t5v7w9x1y" }],
    "truncated": false
  },
  "applications": {
    "open_count": 2,
    "data": [
      {
        "application_id": "app_01j9xq6s0t2v4w6x8y0z2a4b6c",
        "name": "Finance portal",
        "access_mode": "assigned_only",
        "allowed": false,
        "reason": "application_not_assigned"
      }
    ],
    "truncated": false
  }
}

Errors

HTTP code When
404 not_found The membership does not exist in this organization, or it is removed.
401 unauthenticated The credential is missing, invalid or revoked.
403 insufficient_permissions The credential lacks organizations:read or users:read.
429 rate_limited The rate limit was exceeded; retry after the Retry-After period.
503 service_unavailable A dependency is temporarily unavailable; retry after the Retry-After period.

Example

curl -i "https://api.eu.keenauth.com/v1/organizations/org_01j9xk3m7q8r2s4t6v8w0y2z4a/memberships/mem_01j9xn5p9s0t4v6w8x0y2z4a6c/diagnostics" \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"

Personal data

This endpoint carries personal data: organization memberships and invitations, and credentials. Personal data in the KeenAuth APIs describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.