> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Get OIDC user info

> Returns the OIDC-standard user profile for the Bearer token subject.



## OpenAPI

````yaml /pt/openapi/v3-current/AM-auth.yaml get /v1/userinfo
openapi: 3.1.0
info:
  contact:
    name: Lerian Studio
    url: https://lerian.studio
  description: OpenAPI 3.1 surface for the Access Manager auth component.
  license:
    name: Lerian Studio General License
  title: Access Manager Auth API
  version: v1
servers:
  - url: https://auth.sandbox.lerian.net
security: []
tags:
  - description: >-
      OAuth2 token issuance: request an access token, refresh it, and log out.
      Public issuer endpoints.
    name: OAuth
  - description: >-
      Single sign-on through the tenant's identity provider: discover how an
      email signs in, then start the login. Public, called by the browser before
      login.
    name: SSO
  - description: >-
      Multi-factor authentication challenge and verification during the login
      flow. Public (identity is carried by the MFA token, not a Bearer token).
    name: MFA
  - description: >-
      Token-secured routes: enforce a permission, list the caller's permissions,
      and fetch OIDC user info. Require a Bearer token, validated in the use
      case.
    name: User Permission
paths:
  /v1/userinfo:
    get:
      tags:
        - User Permission
      summary: Get OIDC user info
      description: Returns the OIDC-standard user profile for the Bearer token subject.
      operationId: getUserInfo
      parameters:
        - description: >-
            Bearer access token identifying the caller. The request is rejected
            with 401 (AUT-0006) when absent.
          in: header
          name: Authorization
          schema:
            description: >-
              Bearer access token identifying the caller. The request is
              rejected with 401 (AUT-0006) when absent.
            type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserInfo'
          description: OK
        '422':
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/Detail'
          description: Unprocessable Entity
        '500':
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/Detail'
          description: Internal Server Error
        '503':
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/Detail'
          description: Service Unavailable
        default:
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/Detail'
          description: Error
      security:
        - BearerAuth: []
components:
  schemas:
    UserInfo:
      additionalProperties: false
      properties:
        email:
          description: Email address.
          examples:
            - john@example.com
          type: string
        emailVerified:
          description: Whether the email address has been verified.
          examples:
            - true
          type: boolean
        name:
          description: Full display name.
          examples:
            - John Doe
          type: string
        picture:
          description: URL of the user's profile picture.
          examples:
            - https://example.com/picture.jpg
          type: string
        preferredUsername:
          description: Preferred username.
          examples:
            - johndoe
          type: string
        profile:
          description: URL of the user's profile page.
          examples:
            - https://example.com/profile
          type: string
        sub:
          description: Subject identifier (the user's stable id).
          examples:
            - 00000000-0000-0000-0000-000000000000
          type: string
        tenantId:
          description: Tenant (organization) identifier the user belongs to.
          examples:
            - 00000000-0000-0000-0000-000000000000
          type: string
        tenantSlug:
          description: Human-readable tenant slug.
          examples:
            - banco-acme
          type: string
      required:
        - sub
        - name
        - preferredUsername
        - email
        - emailVerified
      type: object
    Detail:
      additionalProperties: true
      properties:
        code:
          description: >-
            Stable, machine-readable domain error code scoped to the emitting
            service (format: <SERVICE>-NNNN).
          type: string
        detail:
          description: >-
            A human-readable explanation specific to this occurrence of the
            problem.
          examples:
            - Property foo is required but is missing.
          type: string
        errors:
          description: Optional list of individual error details
          items:
            $ref: '#/components/schemas/ErrorDetail'
          type:
            - array
            - 'null'
        instance:
          description: >-
            A URI reference that identifies the specific occurrence of the
            problem.
          examples:
            - https://example.com/error-log/abc123
          format: uri
          type: string
        status:
          description: HTTP status code
          examples:
            - 400
          format: int64
          type: integer
        title:
          description: >-
            A short, human-readable summary of the problem type. This value
            should not change between occurrences of the error.
          examples:
            - Bad Request
          type: string
        type:
          default: about:blank
          description: A URI reference to human-readable documentation for the error.
          examples:
            - https://example.com/errors/example
          format: uri
          type: string
        upstream:
          $ref: '#/components/schemas/Upstream'
          description: >-
            RFC 9457 extension member: the error a proxied third-party provider
            reported. Absent unless the emitting service explicitly surfaced
            one.
      type: object
    ErrorDetail:
      additionalProperties: false
      properties:
        location:
          description: >-
            Where the error occurred, e.g. 'body.items[3].tags' or
            'path.thing-id'
          type: string
        message:
          description: Error message text
          type: string
        value:
          description: The value at the given location
      type: object
    Upstream:
      additionalProperties: false
      properties:
        code:
          description: The upstream provider's own error code, verbatim.
          examples:
            - E4001
          type: string
        message:
          description: >-
            The upstream provider's own error message, verbatim (bounded, never
            its raw response body).
          examples:
            - account not found at provider
          type: string
      type: object
  securitySchemes:
    BearerAuth:
      bearerFormat: JWT
      description: JWT bearer token issued by the identity provider.
      scheme: bearer
      type: http

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.