Get an end user

Gets an end user.

Checked 2026-09-28

Gets an end user.

Path GET https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/end_users/end-user
Scope auth:read
Effect read — nothing is written.
Collection end_users

#Request

Field	Type	What it is
`name`	`string`	The name of the end user to get. Required.

#Response

Field	Type	What it is
`name`	`string`	`orgs/{org}/projects/{project}/envs/{env}/end_users/{end_user}`.
`uid`	`string`	`usr_<cell><ulid>`; never reused. Output only.
`meta`	`ResourceMeta`	Resource metadata.
`email`	`string`	The primary email address.
`email_verify_time`	`timestamp`	When `email` was verified. Output only.
`password`	`string`	An initial password; write-only, checked against breached passwords. Never returned again.
`state`	`EndUserState`	The lifecycle state. Output only. One of `active`, `suspended`.
`factors`	`AuthMethod[]`	Enrolled factors. Output only. One of `password`, `magic_link`, `email_otp`, `passkey`, `totp`, `oidc`, `saml`, `device`.
`public_metadata`	`struct`	App data readable by the end user's own tokens.
`private_metadata`	`struct`	App data readable only with an Access key.
`last_login_time`	`timestamp`	The last successful sign-in. Output only.
`unsafe_metadata`	`struct`	App data the end user may write with their own session (preferences a sign-up form collects); never trust it for authorization.
`lock_expire_time`	`timestamp`	Until when sign-in is locked after repeated failures; unset when not locked. Unlock clears it; a suspension is `state`, not a lock. Output only.
`external_ids`	`map<string, string>`	The customer's own ids for this end user, one per namespace (`game_user`, `steam_id`): how an app that signs users in by its own id finds them again. Read on create; never changed through here, because a set namespace's value is never rewritten — `AttachEndUserExternalId` sets an unset one. At most four namespaces. Never an authorization input: scope checks use grant ids.
`synthetic_time`	`timestamp`	When the end user became a test account: set once, when an end user who signed up with an address matching the Auth config's `test_email_pattern` first proved that address by a link or code. No update, import, address change or sign-in method ever sets it; changing the address clears it. Unset for every other end user. Output only.

#ResourceMeta

Field	Type	What it is
`generation`	`int64`	Increases by one on every change to `spec`. Output only.
`etag`	`string`	Strong ETag (AIP-154): changes on any change to spec, status, or metadata. Send it back as `If-Match` or `etag` to make Update and Delete conditional; a mismatch fails with ABORTED / 409 `ETAG_MISMATCH`. Output only.
`create_time`	`timestamp`	When the Resource was created. Output only.
`update_time`	`timestamp`	When the Resource last changed. Output only.
`delete_time`	`timestamp`	Set while the Resource is being deleted. Output only.
`labels`	`map<string, string>`	Caller-writable, indexed labels (AIP-122 label rules).
`annotations`	`map<string, string>`	Caller-writable, unindexed annotations.
`display_name`	`string`	Caller-writable human-readable name.
`creator`	`string`	The principal that created the Resource. Output only.

#Errors

UNAUTHENTICATED — No valid key or token was presented.
PERMISSION_DENIED — The key lacks the method's permission.
RESOURCE_NOT_FOUND — The named Resource does not exist or is not visible.

Every error arrives in the body Errors describes.

#Examples

curl "https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/end_users/end-user" \
  -H "Authorization: Bearer $SYLPHX_API_KEY"

Was this page helpful?

Tell us what is missing, wrong, or unclear — this opens a real inbox.

Send feedback

Platform links