> ## Documentation Index
> Fetch the complete documentation index at: https://team.k0labs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Retrieve user details

> **Visibility:** `public` · `internal` ( OpenAPI Custom Extension: x-visibility )

Retrieve user details and role assignments.




## OpenAPI

````yaml api-docs/k0rdent-api.json get /v1/regions/global/iam/users/{id}
openapi: 3.1.0
info:
  title: K0rdent AI API
  version: 0.2.0-draft
  description: >
    OpenAPI specification for the K0rdent AI GPU-as-a-Service platform.

    **Custom Extensions:**

    - `x-visibility`: Endpoint visibility — `internal` (Atlas only), `public`
    (Arc only), `[internal, public]` (common)

    - `x-status`: Implementation status — `mvp`, `tbd`, `blocked`, `stretch`

    - `x-source`: Source document reference or `TBD` for fields pending
    confirmation

    **Error Model:** Standard `{ error: { code, message, details[] } }`
    envelope.

    **Pagination:** All list endpoints support two modes:

    - **Cursor** (`pageToken` + `pageSize`): Use for frequently updated
    resources. Prevents skipped or duplicated items across pages.
    `nextPageToken` is returned; `total` is not.

    - **Offset** (`offset` + `pageSize`): Use for stable resources. Returns
    `total` for page-count UIs. `nextPageToken` is not returned.

    `pageToken` and `offset` are mutually exclusive. Default `pageSize` is 50,
    maximum is 500.
servers:
  - url: https://api.k0rdent.ai
    description: K0rdent AI API Gateway
security:
  - bearerAuth: []
tags:
  - name: clusters
    description: Kubernetes cluster management
  - name: kubeconfigs
    description: Kubeconfig issuance and management
  - name: instances
    description: VM and baremetal instance lifecycle
  - name: networks
    description: Network configuration and topology
  - name: addresses
    description: IP address management
  - name: servers
    description: Bare metal server lifecycle management
  - name: organizations
    description: Organization (tenant) management
  - name: projects
    description: Project resource grouping
  - name: authentication
    description: Authentication and session management
  - name: users
    description: User management
  - name: groups
    description: User group management
  - name: roles
    description: RBAC role definitions
  - name: policies
    description: IAM policy bindings
  - name: providers
    description: Identity provider configuration
  - name: token
    description: >
      Generate access token via multiple grant types (authorization_code,
      api_key, client_credentials).
  - name: check
    description: >
      Evaluate permissions for a principal against actions and resources.
      Supports single and bulk checks (up to 100).
  - name: introspect
    description: >
      Token introspection per RFC 7662. Validate token activity and retrieve
      full decoded claims.
  - name: revoke
    description: >
      Token revocation per RFC 7009. Explicitly invalidate access tokens before
      natural expiration.
  - name: sessions
    description: >
      Manage user browser sessions. Supports listing active sessions, creating a
      new session (login), and ending the current session (logout).
  - name: apikeys
    description: >
      Manage API keys for programmatic access. API keys are bound to a user and
      inherit a dynamic subset of the user's privileges, evaluated at token-mint
      time.

      Keys are scoped to a level in the resource hierarchy (organization, or
      project).
  - name: serviceaccounts
    description: |
      Manage service accounts for machine-to-machine and infrastructure
      access. Service accounts are independent principals with their own
      identity, role bindings, and credentials. They survive user
      off-boarding and are managed exclusively by tenant administrators.
paths:
  /v1/regions/global/iam/users/{id}:
    parameters:
      - name: id
        in: path
        required: true
        description: Unique user identifier
        schema:
          type: string
    get:
      tags:
        - users
      summary: Retrieve user details
      description: >
        **Visibility:** `public` · `internal` ( OpenAPI Custom Extension:
        x-visibility )


        Retrieve user details and role assignments.
      operationId: getUser
      responses:
        '200':
          description: User details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/User'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
components:
  schemas:
    User:
      type: object
      description: |
        User account object.
      required:
        - id
        - uid
        - email
        - displayName
        - status
        - createdAt
      properties:
        selfLink:
          type: string
          format: uri
          description: Server-defined URL for this resource.
          readOnly: true
          example: /v1/regions/global/iam/users/user-v5w6x7
        uid:
          type: string
          description: Server-generated UUID.
          format: uuid
          readOnly: true
        id:
          type: string
          description: |
            Resource identifier. Provided by the client at creation or
            server-generated if omitted. Must be 1-63 lowercase characters
            matching [a-z]([-a-z0-9]*[a-z0-9])?. Immutable after creation.
          pattern: ^[a-z]([-a-z0-9]*[a-z0-9])?$
          minLength: 1
          maxLength: 63
          example: user-v5w6x7
        email:
          type: string
          format: email
          description: User email address
        displayName:
          type: string
          description: User display name
          minLength: 1
          maxLength: 255
        roles:
          type: array
          items:
            type: string
          description: Assigned role identifiers
        status:
          type: string
          enum:
            - active
            - suspended
            - disabled
          description: User account status
          readOnly: true
        createdAt:
          type: string
          format: date-time
          description: User creation timestamp
          readOnly: true
        updatedAt:
          type: string
          format: date-time
          description: User last update timestamp
          readOnly: true
    Error:
      type: object
      description: Standard error response
      properties:
        error:
          type: object
          properties:
            code:
              type: integer
              description: HTTP status code
            message:
              type: string
              description: Error message
            details:
              type: array
              items:
                type: object
              description: Additional error details
  responses:
    Unauthorized:
      description: Unauthorized
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Forbidden:
      description: Forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    NotFound:
      description: Not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    InternalServerError:
      description: Internal server error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Bearer token authentication using OAuth2/OIDC tokens

````