List users whose tenant anchors disagree

GET

/api/v1/tenant-consistency/users

const url = 'http://localhost:3000/api/v1/tenant-consistency/users?classification=consistent&page=1&limit=25';
const options = {method: 'GET', headers: {'X-API-Key': '<X-API-Key>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'http://localhost:3000/api/v1/tenant-consistency/users?classification=consistent&page=1&limit=25' \
  --header 'X-API-Key: <X-API-Key>'

Compares each user’s database organization memberships with the SET of values of the Keycloak organization_id attribute (order is ignored: Keycloak does not preserve it). Each row lists the organizations missing in and extra in Keycloak. Without a classification filter, consistent users are not listed. Requires Super Admin privileges.

Authorizations

api-key
bearer

Parameters

Query Parameters

classification

string

Allowed values: consistent hanging unassigned keycloak-attribute-names-unknown-org keycloak-only

Only list users with this classification. Omit to list every inconsistent user (everything except “consistent”).

page

number

default: 1 >= 1

limit

number

default: 25 >= 1 <= 100

Header Parameters

x-organization-id

string format: uuid

UUID of the organization (tenant) the request acts in. It selects the tenant and grants nothing: the server checks membership or an open tenant switch. Not needed for global operations. A malformed value returns 400. API keys are fixed to their own organization; another organization returns 403. The x-organization-source header grants nothing.

Responses

200

application/json

object

data

required

Array<object>

object

userId

required

Logiccloud orchestrate user id; null for a “keycloak-only” account (FM-1441).

string format: uuid

nullable

email

required

string

keycloakId

required

Keycloak user id, if linked.

string

nullable

classification

required

string

Allowed values: consistent hanging unassigned keycloak-attribute-names-unknown-org keycloak-only

databasePrimaryOrganization

required

Database primary organization, or null when the user has no membership.

object

required

string format: uuid

name

required

Organization name, or null when the id names no organization (unknown).

string

nullable

keycloakOrganizations

required

Organizations named by the Keycloak organization_id attribute, de-duplicated (name is null when an id is unknown). A set: Keycloak does not preserve attribute order, so no position carries meaning.

Array<object>

object

required

string format: uuid

name

required

Organization name, or null when the id names no organization (unknown).

string

nullable

keycloakOrganizationIds

required

Every value of the Keycloak organization_id attribute, de-duplicated. Order is not meaningful.

Array<string>

missingInKeycloak

required

Organizations the user is a member of that the Keycloak attribute does not contain (the whole membership set when the attribute or the Keycloak account is absent).

Array<object>

object

required

string format: uuid

name

required

Organization name, or null when the id names no organization (unknown).

string

nullable

extraInKeycloak

required

Organizations named by the Keycloak attribute that the user is not a member of, including ids of organizations that do not exist (name is null).

Array<object>

object

required

string format: uuid

name

required

Organization name, or null when the id names no organization (unknown).

string

nullable

keycloakLinked

required

Whether the logiccloud orchestrate user row is linked to a Keycloak account.

boolean

emailVerified

required

object

database

required

Users.emailVerified in the logiccloud orchestrate database, or null for a “keycloak-only” account that has no row (FM-1441).

boolean

nullable

keycloak

required

EmailVerified in Keycloak, or null when there is no Keycloak account to read.

boolean

nullable

total

required

Rows matching the filter, before pagination.

number

page

required

number

limit

required

number

summary

required

Counts over ALL users.

object

consistent

required

number

hanging

required

number

unassigned

required

number

keycloakAttributeNamesUnknownOrg

required

Count of “keycloak-attribute-names-unknown-org” users.

number

keycloakUsersWithoutFleetManagerRow

required

Keycloak accounts with no logiccloud orchestrate user row, listed with the classification “keycloak-only” (FM-1441). Service-account users are not counted.

number

Example

{
  "data": [
    {
      "classification": "consistent"
    }
  ]
}

400

Invalid query parameter

403

Forbidden - Super Admin required

503

Keycloak is not configured