Users
Users
List users
Update user
ModelsExpand Collapse
class User: …An authenticated user entity
An authenticated user entity
Unique identifier of the user
Entity creation timestamp
Email address of the user
Whether the email address has been verified
Zone-scoped user identifier. Defaults to the user's Keycard ID. When the provider has user_identifier_claim configured, the value is set from that claim at user creation time.
Organization that owns this user
status: Literal["active", "disabled"]Status of the user. Disabled users cannot authenticate.
Status of the user. Disabled users cannot authenticate.
Entity update timestamp
Zone this user belongs to
Date when the user was last authenticated
credentials: Optional[List[Credential]]Authentication credentials for this user, each carrying its identity provider for federation credentials. Populated only when expand[]=credentials is set on the listing endpoint.
Authentication credentials for this user, each carrying its identity provider for federation credentials. Populated only when expand[]=credentials is set on the listing endpoint.
class CredentialIamUserCredentialFederation: …Federation credential: the user authenticates through an identity provider.
Federation credential: the user authenticates through an identity provider.
Entity creation timestamp
ID of the identity provider backing this credential. null when the source provider has been deleted.
Entity update timestamp
Issuer identifier of the identity provider.
provider: Optional[Provider]A Provider is a system that supplies access to Resources and allows actors (Users or Applications) to authenticate.
A Provider is a system that supplies access to Resources and allows actors (Users or Applications) to authenticate.
Unique identifier of the provider
Entity creation timestamp
User specified identifier, unique within the zone
Human-readable name
Organization that owns this provider
owner_type: Literal["platform", "customer"]Who owns this provider. Platform-owned providers cannot be modified via API.
Who owns this provider. Platform-owned providers cannot be modified via API.
URL-safe identifier, unique within the zone
Entity update timestamp
Zone this provider belongs to
OAuth 2.0 client identifier
Indicates whether a client secret is configured
Human-readable description
metadata: Optional[Metadata]Provider metadata
Provider metadata
Icon URL
protocols: Optional[Protocols]Protocol-specific configuration
Protocol-specific configuration
oauth2: Optional[ProtocolsOauth2]OAuth 2.0 protocol configuration
OAuth 2.0 protocol configuration
OIDC issuer URL used for discovery and token validation.
Custom query parameters appended to authorization redirect URLs. Use for non-standard providers (e.g. Google prompt=consent, access_type=offline).
Whether to include the resource parameter in authorization requests.
The resource parameter value to include in authorization requests. Defaults to "resource" when authorization_resource_enabled is true.
The query parameter name for scopes in authorization requests. Defaults to "scope". Slack v2 uses "user_scope".
The separator character for scope values. Defaults to " " (space). Slack v2 uses ",".
Dot-separated path to the access token in the token response body. Defaults to "access_token". Slack v2 uses "authed_user.access_token".
openid: Optional[ProtocolsOpenid]OpenID Connect protocol configuration
OpenID Connect protocol configuration
Name of the OIDC claim carrying the stable external id used to correlate logins with externally provisioned (SCIM) users. Defaults to "sub". Set to "oid" for Entra, whose pairwise "sub" differs from the SCIM externalId.
Additional OIDC scopes to request from this provider during authentication (e.g. "groups"). Merged with the default scopes (openid, profile, email).
When true, logging out of the zone propagates the logout to this provider's end_session_endpoint (RP-initiated logout). Defaults to false.
Name of a top-level string claim in this provider's ID Token to use as the user identifier on user creation. When not set, the user's Keycard ID is used.
type: Optional[Literal["external", "keycard-vault", "keycard-sts"]]
Subject identifier from the identity provider.
class CredentialIamUserCredentialPassword: …Password credential: the user authenticates with email and password. The email lives on the user.
Password credential: the user authenticates with email and password. The email lives on the user.
Entity creation timestamp
Entity update timestamp
Delegated-grant count for this user. Populated only when expand[]=grant_count is set on the listing endpoint.
groups: Optional[List[Group]]Groups this user belongs to within the zone. Populated only when expand[]=groups is set on the listing endpoint.
Groups this user belongs to within the zone. Populated only when expand[]=groups is set on the listing endpoint.
Unique identifier of the group
Zone-unique slug that policy rules match on.
Human-readable group name
Issuer identifier of the identity provider
Reference to the identity provider. This field is undefined when the source identity provider is deleted but the user is not deleted.
role_assignments: Optional[List[RoleAssignment]]Role grants for this user within the zone. Populated only when expand[]=role-assignments is set on the listing endpoint.
Role grants for this user within the zone. Populated only when expand[]=role-assignments is set on the listing endpoint.
ID of the assigned role
Role identifier: a lowercase slug (letters and digits separated by single hyphens or underscores), unique per owner type within a zone. Role identifiers surface in policy evaluation, so the slug restriction keeps them unambiguous in policy text.
role_owner_type: Literal["platform", "customer"]Owner type of the granted role. Disambiguates roles that share an identifier across owner types.
Owner type of the granted role. Disambiguates roles that share an identifier across owner types.
scope: Optional[RoleAssignmentScope]The resource this grant is scoped to, or null when the grant is unscoped (applies to the owning zone itself).
The resource this grant is scoped to, or null when the grant is unscoped (applies to the owning zone itself).
The ID of the scoped resource.
The kind of resource this grant is scoped to (e.g. zone).
source: Literal["user", "group"]The principal that holds this grant: user when assigned directly to the user, or group when inherited through group membership.
The principal that holds this grant: user when assigned directly to the user, or group when inherited through group membership.
ID of the group this grant is inherited from. Present only when source is group.
Session count for this user. Populated only when expand[]=session_count is set on the listing endpoint.
Subject identifier from the identity provider
UsersRoles
List user role assignments
Assign role to user
Revoke role from user
ModelsExpand Collapse
class RoleAssignment: …Represents a role assigned to a principal within a zone
Represents a role assigned to a principal within a zone
Unique identifier of the role assignment
Entity creation timestamp
ID of the principal the role is assigned to (a user, application, or group ID).
The kind of principal the role is assigned to: user, application, or group. A role assigned to a group is inherited by that group's members.
ID of the assigned role
Role identifier: a lowercase slug (letters and digits separated by single hyphens or underscores), unique per owner type within a zone. Role identifiers surface in policy evaluation, so the slug restriction keeps them unambiguous in policy text.
role_owner_type: Literal["platform", "customer"]Owner type of the assigned role. Disambiguates roles that share an identifier across owner types.
Owner type of the assigned role. Disambiguates roles that share an identifier across owner types.
Entity update timestamp
Zone this assignment belongs to
The ID of the scoped resource. Null when the assignment is unscoped.
The kind of resource this grant is scoped to (e.g. zone). Null when the assignment is unscoped (applies to the owning zone itself).
class RoleAssignmentCreate: …Schema for assigning a role to a principal. Provide exactly one of role_id or role_identifier. When role_identifier is used, owner_type is required to disambiguate roles that share an identifier across owner types; owner_type must be omitted when role_id is used.
Schema for assigning a role to a principal. Provide exactly one of role_id or role_identifier. When role_identifier is used, owner_type is required to disambiguate roles that share an identifier across owner types; owner_type must be omitted when role_id is used.
owner_type: Optional[Literal["platform", "customer"]]Owner type of the role to assign. Required with role_identifier (an identifier is unique only per owner type); must be omitted with role_id.
Owner type of the role to assign. Required with role_identifier (an identifier is unique only per owner type); must be omitted with role_id.
ID of the role to assign. Provide exactly one of role_id or role_identifier; owner_type must be omitted when role_id is used.
Role identifier: a lowercase slug (letters and digits separated by single hyphens or underscores), unique per owner type within a zone. Role identifiers surface in policy evaluation, so the slug restriction keeps them unambiguous in policy text.
The ID of the resource to scope the grant to. Provide together with scope_type, or omit both for an unscoped assignment. When scope_type is zone, this must reference a different zone in the same organization.
The kind of resource to scope the grant to (e.g. zone). Provide together with scope_id, or omit both for an unscoped assignment (applies to the owning zone itself). Only platform roles on the org zone may carry a scope.