---
title: "Get User Detail"
method: GET
path: "/api/admin/users/{user_id}"
tags: ["admin"]
---

# Get User Detail

`GET /api/admin/users/{user_id}`

Return identity, subscription, profile config, and integrations.

Slimmed in #325 work item 2: user-authored content (memory, soul,
user text, heartbeat directives, message bodies, tool-call args /
results) was removed from this default response. Content surfaces
only via the consent-gated paths — ``/admin/reported-conversations``
(after a user reports a conversation) or ``/admin/shared-data``
(when a user opted into data sharing) — once items 3 + 4 land.

Eager-loads ``tool_configs`` and ``channel_routes`` via selectinload
so we make one round-trip instead of three.

## Path parameters

- `user_id` string, required

## Response `200`

Successful Response

- AdminUserDetailResponse — Identity, account state, and configuration metadata for one user. User-authored content (memory, soul, user text, heartbeat directives, message bodies, tool-call args/results) was removed in #325 work item 2. The plan: content surfaces only via the consent-gated paths (``/admin/reported-conversations`` and ``/admin/shared-data``) once items 3 + 4 land. Until then, admins debugging an incident see the metadata + integrations here, plus the audit log of who looked. Channel routes carry a *masked* ``channel_identifier`` — phone numbers / iMessage emails / Telegram chat IDs are PII the admin rarely needs in full. The route applies ``_mask_channel_identifier`` so admins see enough to recognize a route and confirm last-4 digits, not enough to dial / message directly from the admin panel.
  - `id` string, required
  - `user_id` string, required
  - `email` string, required
  - `plan` string, required
  - `status` string, required
  - `role` string, required
  - `is_active` boolean, required
  - `onboarding_complete` boolean, required
  - `subscription_created_at` string, nullable, required
  - `subscription_updated_at` string, nullable, required
  - `timezone` string, required
  - `preferred_channel` string, required
  - `heartbeat_opt_in` boolean, required
  - `heartbeat_frequency` string, required
  - `tool_configs` AdminToolConfigEntry[], required
    - `tool_name` string, required
    - `enabled` boolean, required
  - `channel_routes` AdminChannelRouteEntry[], required
    - `channel` string, required
    - `channel_identifier` string, required
    - `enabled` boolean, required
    - `last_inbound_at` string, nullable, required
  - `permissions` AdminUserPermissions, required — Per-user tool/resource permission overrides. Mirrors the JSON document at ``user_permissions.data``: the tool list is the top-level approval level for each tool, and resources are the finer-grained overrides keyed by (tool, resource pattern).
    - `tools` AdminUserPermissionEntry[], required
      - `tool_name` string, required
      - `level` string, required
    - `resources` AdminUserResourcePermissionEntry[], required
      - `tool_name` string, required
      - `resource` string, required
      - `level` string, required

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/mozilla-ai/apis/clawbolt.md) · [All operations](https://skmtc.net/mozilla-ai/apis/clawbolt/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/mozilla-ai/clawbolt/revisions/0e52fe5f8d33/schema)