Get user (deprecated path)

Returns a single Enterprise user.

GET /api/users/{user_id}

Error

A valid request URL is required to generate request examples

200

{
  "id": "<string>",
  "name": "<string>",
  "email": "[e-mail]",
  "role_id": 123,
  "role": {
    "id": 123,
    "name": "<string>",
    "description": "<string>",
    "is_system_role": true
  },
  "created_at": "2023-11-07T05:31:56Z",
  "updated_at": "2023-11-07T05:31:56Z",
  "teams": [
    {
      "id": "<string>",
      "name": "<string>"
    }
  ],
  "business_units": [
    {
      "id": "<string>",
      "name": "<string>"
    }
  ],
  "access_profiles": [
    {
      "id": 123,
      "user_id": "<string>",
      "parent_profile_id": 123,
      "name": "<string>",
      "is_active": true,
      "expires_at": "2023-11-07T05:31:56Z",
      "created_at": "2023-11-07T05:31:56Z",
      "updated_at": "2023-11-07T05:31:56Z"
    }
  ],
  "access_profile": {
    "id": 123,
    "user_id": "<string>",
    "parent_profile_id": 123,
    "name": "<string>",
    "is_active": true,
    "expires_at": "2023-11-07T05:31:56Z",
    "created_at": "2023-11-07T05:31:56Z",
    "updated_at": "2023-11-07T05:31:56Z"
  }
}

This path is deprecated and will be removed in the following major release. Use /api/governance/users/{user_id} instead.

This endpoint is available in Bifrost Enterprise only.

Authorizations

ManagementBearerAuthBasicAuth

Authorization · string · header · required

Management API authentication for /api/* endpoints. Use the Authorization header with Bearer <token>, where <token> is one of:

• a Bifrost management API key,
• a dashboard session token issued by POST /api/session/login,
• base64 of <admin-username>:<admin-password> (legacy equivalent of BasicAuth).

Virtual keys (sk-bf-*) and the x-api-key header are not accepted on management APIs - the sole exception is GET /api/governance/virtual-keys/quota, which is virtual-key-only.

Path Parameters

user_id · string · required

User ID

Response

200

application/json

Successful response

id · string

Unique user identifier

name · string

User's display name

email · string<email>

User's email address

role_id · integer | null

ID of the assigned RBAC role

role · object | null

RBAC role details

Show child attributes

created_at · string<date-time>

updated_at · string<date-time>

teams · object[]

Teams the user belongs to.

Show child attributes

business_units · object[]

Business units the user belongs to. Membership is many-to-many and belongs to the user, so this is the authoritative list; manage it under /api/governance/business-units/{business_unit_id}/users.

Show child attributes

access_profiles · (object | null)[]

Every access profile the user holds, one per assignment source. All of them are enforced — their budgets, rate limits, and provider access combine.

Active or fallback user access profile, if assigned.

Show child attributes

access_profile · object | null

Deprecated. A single-value summary of the highest-precedence profile (attribute_mapping > role_default > manual), kept for clients written before a user could hold several. It grants nothing on its own — read access_profiles instead.

Show child attributes