Skip to content
Authrim

Read an end user's account status without personal data.

GET
/api/admin/investigations/subjects/{handle}/status
Code sample: Shell / cURL 
curl --request GET \
  --url https://auth.example.com/api/admin/investigations/subjects/example/status \
  --header 'Authorization: Bearer <token>'

Returns the status of one end user’s account as the Core database holds it, for investigating a sign-in problem without personal data. Requires admin:users:status:read (included in admin:users:read). The handle names the subject through an entry point, and each entry point adds its own requirement: user:<user id> is accepted only from callers who also hold admin:users:read. Only end-user accounts are answered for; admin and service accounts are not found here. Stored states are returned from closed sets. The response never contains names, contact values, email domains, user-chosen credential or device names, IP addresses, user agents or external subject identifiers. Parts Core does not record (sessions, linked providers) are reported as not recorded rather than as empty. Recent failed sign-in attempts are listed when they were made within a Flow interaction. Every read is recorded in the Admin audit log with its entry point.

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “Path Parameters ”
handle
required
string
>= 1 characters <= 512 characters

Subject handle, user:<user id>.

Header Parameters

Section titled “Header Parameters ”
X-Tenant-Id
string

Tenant selector for multi-tenant admin requests.

Responses

Section titled “ Responses ”

200

Section titled “200 ”

Account status from Core.

Media type application/json

Times are epoch milliseconds.

object
subject
required
object
entry_point
required

How the subject was reached.

string
Allowed values: user_id
key
additional properties
source
required
string
Allowed values: core
account
required
object
registration_state
required
string
Allowed values: guest registered
is_guest
required
boolean
lifecycle_state
required

A Core account state; any value Core does not define is other.

string
Allowed values: active inactive suspended locked deleting deleted invited pending_verification provisioning incomplete dormant archived deprovisioned other
status
required
string
Allowed values: active inactive suspended locked deleting deleted invited pending_verification provisioning incomplete dormant archived deprovisioned other
suspended_at
required
integer | null
suspended_until
required
integer | null
locked_at
required
integer | null
locked_until
required
integer | null
created_at
required
integer | null
updated_at
required
integer | null
last_login_at
required
integer | null
guest_deletion_due_at
required
integer | null
key
additional properties
legal_hold
required
object
active
required
boolean
key
additional properties
credentials
required
object
password
required
object
configured
required
boolean
key
additional properties
email
required

Whether an email contact is registered and verified; the address is not read.

object
registered
required
boolean
verified
required
boolean
key
additional properties
passkeys
required
Array<object>
object
provider_name
required

Authenticator provider resolved from the AAGUID, not the name the user chose.

string | null
transports
required
Array<string>
Allowed values: usb nfc ble internal hybrid smart-card
created_at
required
integer | null
last_used_at
required
integer | null
key
additional properties
totp
required
Array<object>
object
status
required
string
Allowed values: pending active disabled other
created_at
required
integer | null
activated_at
required
integer | null
last_used_at
required
integer | null
key
additional properties
key
additional properties
sessions
required

A part of the status Core does not record (sessions live in the session store, linked providers in the PII store). It means unknown here, not none.

object
available
required
boolean
reason
required
string
Allowed values: not_recorded_in_core
key
additional properties
devices
required
object
available
required
boolean
total
required
integer
active
required
integer
items
required
Array<object>
<= 50 items
object
platform
required
string | null
Allowed values: ios android macos windows other
created_at
required
integer | null
last_used_at
required
integer | null
expires_at
required
integer | null
use_count
required
integer
active
required
boolean
revoked_at
required
integer | null
key
additional properties
key
additional properties
linked_providers
required

A part of the status Core does not record (sessions live in the session store, linked providers in the PII store). It means unknown here, not none.

object
available
required
boolean
reason
required
string
Allowed values: not_recorded_in_core
key
additional properties
recent_attempts
required
One of:
object
available
required
boolean
coverage
required
string
Allowed values: flow_interactions
total
required

Every recorded failure of the account still held in D1.

integer
truncated
required

Whether items leaves out older attempts.

boolean
summary
required

The failures by method and reason, latest first.

Array<object>
object
method
required
string
Allowed values: passkey totp email_code directory_password external_idp saml other
reason_code
required
string
Allowed values: challenge_expired challenge_mismatch method_disabled credential_not_found verification_failed invalid_code replay_detected rate_limited account_mismatch account_unavailable guest_denied service_unavailable account_not_linked migration_blocked upstream_error email_not_verified signup_disabled assurance_not_met policy_denied provisioning_failed other
count
required
integer
>= 1
first_at
required
integer | null
last_at
required
integer | null
key
additional properties
items
required
Array<object>
<= 20 items
object
created_at
required
integer | null
method
required
string
Allowed values: passkey totp email_code directory_password external_idp saml other
result
required
string
Allowed values: failure
reason_code
required
string
Allowed values: challenge_expired challenge_mismatch method_disabled credential_not_found verification_failed invalid_code replay_detected rate_limited account_mismatch account_unavailable guest_denied service_unavailable account_not_linked migration_blocked upstream_error email_not_verified signup_disabled assurance_not_met policy_denied provisioning_failed other
key
additional properties
key
additional properties
log_coverage
object
consistency
required
string
Allowed values: snapshot eventual local_hot_only
pending_deliveries
required

Null for self-service subjects that cannot inspect tenant delivery counts.

integer | null
complete
required

Pipeline and local staging-only views remain false even when no pending deliveries are known.

boolean
key
additional properties
key
additional properties
Example 
{
  "subject": {
    "entry_point": "user_id"
  },
  "source": "core",
  "account": {
    "registration_state": "guest",
    "lifecycle_state": "active",
    "status": "active"
  },
  "credentials": {
    "passkeys": [
      {
        "transports": [
          "usb"
        ]
      }
    ],
    "totp": [
      {
        "status": "pending"
      }
    ]
  },
  "sessions": {
    "available": false,
    "reason": "not_recorded_in_core"
  },
  "devices": {
    "available": true,
    "items": [
      {
        "platform": "ios"
      }
    ]
  },
  "linked_providers": {
    "available": false,
    "reason": "not_recorded_in_core"
  },
  "recent_attempts": {
    "available": true,
    "coverage": "flow_interactions",
    "summary": [
      {
        "method": "passkey",
        "reason_code": "challenge_expired"
      }
    ],
    "items": [
      {
        "method": "passkey",
        "result": "failure",
        "reason_code": "challenge_expired"
      }
    ]
  },
  "log_coverage": {
    "consistency": "snapshot"
  }
}

Headers

Section titled “Headers ”
X-Authrim-Log-Consistency
string
Allowed values: snapshot eventual local_hot_only

Snapshot for the remote scheduled view; eventual when Pipeline visibility can lag ingestion; local_hot_only for local scheduled staging without a remote Catalog.

X-Authrim-Log-Pending-Deliveries
integer

Tenant deliveries not yet confirmed visible. Omitted for self-service subjects. Zero does not guarantee immediate Pipeline visibility.

X-Authrim-Log-Complete
boolean

True only for a complete bounded snapshot query. Pipeline responses remain false; incomplete reads return 503.

Cache-Control
string
Allowed values: no-store

401

Section titled “401 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

403

Section titled “403 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

404

Section titled “404 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

500

Section titled “500 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

503

Section titled “503 ”

The retained log query is incomplete. No partial entries or statistics are returned as a successful result. Narrow the period or retry.

Media type application/json
object
error
required
string
Allowed value: log_query_incomplete
error_description
required
string
complete
required
boolean
key
additional properties
Example 
{
  "error": "log_query_incomplete",
  "complete": false
}