Get a machine access principal

GET

/api/admin/machine-access/principals/{id}

Code sample: Shell / cURL

curl --request GET \
  --url https://auth.example.com/api/admin/machine-access/principals/example \
  --header 'Authorization: Bearer <token>'

Return a single machine principal if it is within the current admin tenant scope.

Authorizations

• adminBearer
• adminSessionCookie

Parameters

Path Parameters

id

required

string

Responses

200

Machine principal.

Media type application/json

object

principal

required

object

id

string

clientId

string

displayName

string

description

Any of:

string

string

null

null

principalType

string

Allowed values: setup_tool admin_ui_bff automation ci mcp_server ai_agent internal_service integration

status

string

Allowed values: active disabled deleted

tokenTtlSeconds

integer format: int64

createdAt

integer format: int64

updatedAt

integer format: int64

permissions

Array<string>

tenantScopes

Array<object>

object

scope_mode

required

string

Allowed values: none all allow

tenant_id

Any of:

string

string

null

null

credentials

Array<object>

object

id

string

principalId

string

kid

string

publicJwkJson

string

alg

string

Allowed values: ES256 PS256 RS256

displayName

string

description

Any of:

string

string

null

null

status

string

Allowed values: active rotating revoked expired

notBefore

Any of:

integer

integer format: int64

null

null

expiresAt

Any of:

integer

integer format: int64

null

null

createdAt

integer format: int64

updatedAt

integer format: int64

Example

{
  "principal": {
    "id": "amp_123",
    "clientId": "setup-tool",
    "displayName": "Setup Tool",
    "description": "Automation used by setup.",
    "principalType": "setup_tool",
    "status": "active",
    "tokenTtlSeconds": 600,
    "createdAt": 1770000000000,
    "updatedAt": 1770000000000,
    "permissions": [
      "admin:tenants:read"
    ],
    "tenantScopes": [
      {
        "scopeMode": "allow",
        "tenantId": "tenant_123"
      }
    ],
    "credentials": []
  }
}

default

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}