Read committed service memberships with versions and freshness

GET

/api/admin/service-groups/subjects/{userId}

Code sample: Shell / cURL

curl --request GET \
  --url https://auth.example.com/api/admin/service-groups/subjects/example \
  --header 'Authorization: Bearer <token>'

Service-user membership only; this operation does not grant authorization or emit token claims. Tenant scope is required. Reads require admin:users:read; mutations and previews require admin:users:write. Rule changes use ifMatch optimistic concurrency; a stale version returns 409. Missing or disabled group references, cycles and invalid typed comparisons are rejected. Malformed, empty or non-object JSON request bodies return 400 with group_request_invalid. Only complete per-user snapshots are published. During reconciliation, old snapshots remain readable with stale status; pending or failed results must not be treated as current membership.

Authorizations

• adminBearer
• adminSessionCookie

Parameters

Path Parameters

userId

required

string

<= 128 characters

Header Parameters

X-Tenant-Id

string

Tenant selector for multi-tenant admin requests.

Responses

200

Successful operation.

Media type application/json

object

tenantId

required

string

userId

required

string

ruleVersion

required

integer

generation

required

integer

evaluatedAt

Unix milliseconds.

integer

nullable

freshness

required

string

Allowed values: fresh stale pending failed

inputVersion

required

object

route

Opaque account routing generation.

string

core

integer

pii

integer

metadata

integer

epoch

integer

evaluation

required

object

groups

object

key

additional properties

object

member

One of:

boolean

boolean

string

string

Allowed values: unknown

dynamic

One of:

boolean

boolean

string

string

Allowed values: unknown

sources

Array<string>

Allowed values: manual scim dynamic

nodes

object

key

additional properties

evaluatedNodes

integer

explanation

Array<object>

object

compare

string

Allowed values: eq in contains lt lte gt gte

expected

One of:

string

string

number

number

boolean

boolean

Array

Array

children

IDs of child condition results

Array<string>

node

string

operator

string

field

string

groupId

string

result

One of:

boolean

boolean

string

string

Allowed values: unknown

unsettledWrites

Up to 50 outstanding writes per storage source. Active writers cannot be recovered here.

Array<object>

object

id

string

operation

string

status

string

Allowed values: writing failed

created_at

integer

error

string

nullable

Example

{
  "freshness": "fresh",
  "evaluation": {
    "groups": {
      "additionalProperty": {
        "member": "unknown",
        "dynamic": "unknown",
        "sources": [
          "manual"
        ]
      }
    }
  },
  "explanation": [
    {
      "compare": "eq",
      "result": "unknown"
    }
  ],
  "unsettledWrites": [
    {
      "status": "writing"
    }
  ]
}

400

Invalid condition, reference, subject, or unavailable stable input.

Media type application/json

object

error

required

string

Example ^generated

{
  "error": "example"
}

401

Authentication required.

Media type application/json

object

error

required

string

Example ^generated

{
  "error": "example"
}

403

Insufficient tenant-scoped permissions.

Media type application/json

object

error

required

string

Example ^generated

{
  "error": "example"
}

404

Group not found.

Media type application/json

object

error

required

string

Example ^generated

{
  "error": "example"
}

409

Rule version conflict or concurrent evaluation.

Media type application/json

object

error

required

string

Example ^generated

{
  "error": "example"
}

503

Input storage unavailable. No partial result was published.

Media type application/json

object

error

required

string

Example ^generated

{
  "error": "example"
}