Skip to main content
ZStack
Identity & Access/ZIAM

ZiamGetUserInfo

Returns the current user's OIDC userinfo from the validated access token and current ZIAM data. The custom roles claim is resolved when this endpoint is called and includes enabled direct, group, project, organization, relationship, and custom role assignments; it is not the role snapshot carried by the access token. The aggregate roles field has no Project attribution and cannot prove authorization in a specified Project. Project authorization must use that Project's active ProjectMembership.roleKeys or a Project-aware role-grants API.

GET/api/userinfo

Operation ID

ZiamGetUserInfo

Since

1.0.0

Execution Mode

Synchronous

Auth Context

Auth Required

Auth Context

Send these values as request headers when calling this API.

AuthorizationstringRequired

Bearer Token

X-Tenant-IDstring

X-Tenant-ID

Request Inputs

This API requires no request parameters.

Responses

200 OK
200 OK

On success, this API returns the following response structure.

  • sub
    String

    OIDC subject identifier.

    Example: 11111111111111111111111111111111

  • ziam_subject_type
    String

    Signed ZIAM subject type used with sub to load the current principal without cross-type fallback.

    Example: User

  • preferred_username
    String

    Preferred login name.

    Example: alice

  • name
    String

    Display name.

    Example: Alice

  • email
    String

    User email.

    Example: alice@example.com

  • phone
    String

    User phone number when available.

    Example: +8613800138000

  • picture
    String

    Avatar URL when available.

    Example: https://example.com/avatar.png

  • source
    String

    Identity source. ZIAM-created resources use ZIAM.

    Example: ZIAM

  • status
    String

    Normalized user status.

    Example: Enabled

  • createdAt
    String

    Normalized creation time.

    Example: 2026-06-16T09:00:00Z

  • updatedAt
    String

    Normalized update time.

    Example: 2026-06-16T09:30:00Z

  • lastLoginTime
    String

    Normalized last login time. ZIAM copies this from lastSigninTime when needed.

    Example: 2026-06-16T10:00:00Z

  • lastLoginIp
    String

    Normalized last login IP. ZIAM copies this from lastSigninIp when needed.

    Example: 172.26.53.126

  • roles
    List

    Current effective ZIAM role keys resolved at userinfo request time. The set includes enabled direct role bindings, roles inherited through groups, projects and organizations, role keys attached to those relationships, and enabled custom roles. This aggregate has no Project attribution and must not be trusted without current relationship validation. project-admin is global, but authorization must verify the current enabled User/Group RoleBinding and Role through a Project-aware role-grants API; project-owner remains tied to the target ProjectMembership. Changes are reflected without issuing a new access token.

    Example: item1,item2

Change History

View all change history

  • Change Time

    AddedResponse fields roles, ziam_subject_type
    View API