---
title: "Retrieve social identities, enterprise SSO identities and associated token secret (if token storage is enabled) for a user."
method: GET
path: "/api/users/{userId}/all-identities"
tags: ["Users"]
---

# Retrieve social identities, enterprise SSO identities and associated token secret (if token storage is enabled) for a user.

`GET /api/users/{userId}/all-identities`

This API retrieves all identities (social and enterprise SSO) for a user, along with their associated token set records from the Logto Secret Vault. The token sets will only be available if token storage is enabled for the corresponding identity connector.

## Path parameters

- `userId` string, required

## Query parameters

- `includeTokenSecret` string

## Response `200`

Returns the user's social identities, enterprise SSO identities and associated token secret.

- object
  - `socialIdentities` object[], required — The user's social identities.
    - `identity` object, required
      - `userId` string, required
      - `details` object — arbitrary
    - `tokenSecret` object
      - `tenantId` string, required
      - `id` string, required
      - `userId` string, required
      - `type` string, "federated_token_set", required
      - `metadata` object, required
        - `scope` string
        - `expiresAt` number
        - `tokenType` string
        - `hasRefreshToken` boolean, required
      - `createdAt` number, required
      - `updatedAt` number, required
      - `connectorId` string, required
      - `identityId` string, required
      - `target` string, required
    - `target` string, required
  - `ssoIdentities` object[], required — The user's enterprise SSO identities.
    - `ssoIdentity` object, required
      - `tenantId` string, required
      - `id` string, required
      - `userId` string, required
      - `issuer` string, required
      - `identityId` string, required
      - `detail` object, required — arbitrary
      - `createdAt` number, required
      - `updatedAt` number, required
      - `ssoConnectorId` string, required
    - `tokenSecret` object
      - `tenantId` string, required
      - `id` string, required
      - `userId` string, required
      - `type` string, "federated_token_set", required
      - `metadata` object, required
        - `scope` string
        - `expiresAt` number
        - `tokenType` string
        - `hasRefreshToken` boolean, required
      - `createdAt` number, required
      - `updatedAt` number, required
      - `ssoConnectorId` string, required
      - `issuer` string, required
      - `identityId` string, required
    - `ssoConnectorId` string, required

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — User not found.

---

[API](https://skmtc.net/logto/apis/logto-api-references.md) · [All operations](https://skmtc.net/logto/apis/logto-api-references/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/logto/logto-api-references/revisions/a163dc77d842/schema)