# List a user's linked identities

`GET /v1/users/{user_id}/identities` · permission `users:read`

Lists the linked identities of a user (password, social, SAML, OIDC and legacy) in one page, ordered by creation time. The number of identities per user is bounded, so the list has no `limit`, `after`, `before` or `order`, and `list_metadata` is always `null` valued. The external subject of an identity (OIDC `sub`, SAML NameID), the email address reported by the identity provider and the credential reference are never returned. Passkeys and one-time code methods are authenticators and are listed by `GET /v1/users/{user_id}/authenticators`.

## Request

| Parameter | In | Required | Description |
|---|---|---|---|
| `user_id` | path | yes | User id, prefixed `usr_`. |

## Response

`200 OK`. `data` holds the identities ordered by creation time; `list_metadata` is always `null` valued because the list is not paginated. `connection_id` is `null` for `password`; `provider` is set only for `social`.

Identity ids carry the `idn_` prefix.

```json
{
  "data": [
    {
      "id": "idn_0a1b2c3d4e5f6g7h8j9k0m1n2q",
      "type": "password",
      "connection_id": null,
      "provider": null,
      "linked_via": "primary",
      "created_at": "2026-01-15T09:30:00Z"
    },
    {
      "id": "idn_0a1b2c3d4e5f6g7h8j9k0m1n2r",
      "type": "social",
      "connection_id": "conn_0a1b2c3d4e5f6g7h8j9k0m1n2s",
      "provider": "google",
      "linked_via": "manual_link",
      "created_at": "2026-02-01T08:00:00Z"
    }
  ],
  "list_metadata": {
    "before": null,
    "after": null
  }
}
```

`type`: `password`, `social`, `saml`, `oidc`, `legacy` · `linked_via`: `primary`, `auto_verified_email`, `user_confirmed`, `admin_api`, `import`, `jit`, `auto_domain`, `invite_proof`, `manual_link`, `scim_match`

## Errors

Every error is an `application/problem+json` body with a stable `code`.

| HTTP | `code` | When |
|---|---|---|
| 404 | `not_found` | The user does not exist in this environment (or the id is malformed). |
| 401 | `unauthenticated` | The API key is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The key lacks the `users:read` permission. |
| 429 | `rate_limited` | The rate limit was exceeded; honor `Retry-After`. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry later. |

## Example

```bash
curl https://api.eu.keenauth.com/v1/users/usr_0a1b2c3d4e5f6g7h8j9k0m1n2p/identities \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
```

## Personal data

This endpoint carries personal data: linked identities. [Personal data in the KeenAuth APIs](/docs/policies/personal-data) describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.