---
title: "Retrieve a user's enterprise SSO identity and associated token secret (if token storage is enabled)."
method: GET
path: "/api/users/{userId}/sso-identities/{ssoConnectorId}"
tags: ["Users"]
---

# Retrieve a user's enterprise SSO identity and associated token secret (if token storage is enabled).

`GET /api/users/{userId}/sso-identities/{ssoConnectorId}`

This API retrieves the user's enterprise SSO identity and associated token set record from the Logto Secret Vault. The token set will only be available if token storage is enabled for the corresponding SSO connector.

## Path parameters

- `userId` string, required
- `ssoConnectorId` string, required

## Query parameters

- `includeTokenSecret` string

## Response `200`

Returns the user's enterprise SSO identity and associated token secret.

- object
  - `ssoIdentity` object, required — The user's enterprise SSO identity.
    - `tenantId` string, required
    - `id` string, required
    - `userId` string, required
    - `issuer` string, required
    - `identityId` string, required
    - `detail` object, required — arbitrary
    - `createdAt` number, required
    - `updatedAt` number, required
    - `ssoConnectorId` string, required
  - `tokenSecret` object — The desensitized token set secret associated with the user's SSO identity. This field is included only if the `includeTokenSecret` query parameter is provided and the corresponding connector has token storage enabled.
    - `tenantId` string, required
    - `id` string, required
    - `userId` string, required
    - `type` string, "federated_token_set", required
    - `metadata` object, required
      - `scope` string
      - `expiresAt` number
      - `tokenType` string
      - `hasRefreshToken` boolean, required
    - `createdAt` number, required
    - `updatedAt` number, required
    - `ssoConnectorId` string, required
    - `issuer` string, required
    - `identityId` string, required

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — User enterprise SSO identity not found.

---

[API](https://skmtc.net/logto/apis/logto-api-references.md) · [All operations](https://skmtc.net/logto/apis/logto-api-references/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/logto/logto-api-references/versions/a163dc77d842/schema)