Skip to main content
GET
Get a user

Authorizations

Authorization
string
header
required

Personal Access Token. Send as Authorization: Bearer hq_pat_....

Path Parameters

id
string<uuid>
required

User id

Response

One user

admin_access
string
required

Tenant-admin role override (migration 0132): default (follow the Slack is_admin flag), granted (admin regardless of Slack), or revoked (never admin). Effective admin = granted OR (default AND is_admin), never when revoked.

external_user_id
string
required
id
string<uuid>
required
is_admin
boolean
required
is_bot
boolean
required
is_deleted
boolean
required
is_guest
boolean
required

Whether the transport flags this user as a restricted guest (Slack single-/multi-channel). NULL (not yet discovered) renders as false.

origin
string
required

slack | teams | email - how the identity entered the tenant. Email users are invited + sign in via magic link (migration 0133). Combined with a null last_seen_at the UI shows an "Invited" (pending) state.

signin_access
string
required

HQ sign-in access for this user: default (follows the workspace sign-in mode + guest policy), allowed (explicitly let in), or denied (explicitly blocked). See migration 0129.

source_kind
string
required

slack / teams / manual - the connector that originated this identity.

display_name
string | null

Slack handle ("markus", "jens"). What @-mentions resolve to.

email
string | null
last_seen_at
string<date-time> | null
locale
string | null
real_name
string | null

Full human name ("Markus Persson"). The admin table prefers this in the primary column so users aren't shown as handles.

source_workspace
string | null

Display name of the connected workspace (e.g. "Truespar").

title
string | null
tz
string | null