> ## Documentation Index > Fetch the complete documentation index at: https://docs.flowpayroll.ai/llms.txt > Use this file to discover all available pages before exploring further. # Get a person and their access > Who they are, plus both kinds of access this platform has: - `organisationIds` — every organisation they hold a **direct grant** on. - `coversWholeCustomer` — whether they also hold **account-wide access**, which reaches every organisation the account owns, including ones added later, and names none of them. **Read `coversWholeCustomer` before treating an empty `organisationIds` as no access.** Somebody who runs the whole account typically holds no grant on any single organisation, so the two fields together are the answer. To change either kind, use `/users/{principalId}/organisations` for direct grants and `/users/{principalId}/customer-access` for account-wide access. 404 when the person is not in your account, and for somebody who does not exist — the same answer to both. ## OpenAPI ````yaml /api-reference/specs/administration.json get /users/{principalId} openapi: 3.0.1 info: title: Administration API description: >- Manage your Flow Payroll account: the organisations it owns, the people who can sign in to it, the API tokens it holds, its brand, and a feed of recent administration activity. Every resource is scoped to the account your credentials belong to, so no request ever names a customer and the `X-Org-Id` header is not used. version: v1 servers: - url: https://api.sandbox.flowpayroll.ai/v1/administration security: - X-Auth-Token: [] tags: - name: Customer description: >- Your account: the customer every other resource on this API belongs to. Read it and rename it. - name: Organisations description: >- The organisations your account owns: list them with headcounts and your access to each, get one in full, and add one or several at a time. - name: Users description: >- The people who can sign in to your account: list, invite (one or many), resend invitations, and manage each person's direct grants and account-wide access. - name: API tokens description: >- The client credentials your integrations authenticate with: create (the secret is shown once), rename, rotate, revoke, and manage which organisations each token reaches. - name: Activity description: Recent administration actions in your account, newest first. paths: /users/{principalId}: get: tags: - Users summary: Get a person and their access description: >- Who they are, plus both kinds of access this platform has: - `organisationIds` — every organisation they hold a **direct grant** on. - `coversWholeCustomer` — whether they also hold **account-wide access**, which reaches every organisation the account owns, including ones added later, and names none of them. **Read `coversWholeCustomer` before treating an empty `organisationIds` as no access.** Somebody who runs the whole account typically holds no grant on any single organisation, so the two fields together are the answer. To change either kind, use `/users/{principalId}/organisations` for direct grants and `/users/{principalId}/customer-access` for account-wide access. 404 when the person is not in your account, and for somebody who does not exist — the same answer to both. operationId: GetUser parameters: - name: principalId in: path required: true schema: type: string responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/UserDetailResponseResponseBody' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' components: schemas: UserDetailResponseResponseBody: type: object properties: message: $ref: '#/components/schemas/MessageWithTokenResponse' content: $ref: '#/components/schemas/UserDetailResponseContentResponse' validationIssues: type: array items: $ref: '#/components/schemas/ValidationIssue' nullable: true additionalProperties: false ObjectResponseBody: type: object properties: message: $ref: '#/components/schemas/MessageWithTokenResponse' content: $ref: '#/components/schemas/ObjectContentResponse' validationIssues: type: array items: $ref: '#/components/schemas/ValidationIssue' nullable: true additionalProperties: false MessageWithTokenResponse: type: object properties: text: type: string token: type: string tokenArguments: type: array items: $ref: '#/components/schemas/ValidationIssueArgument' nullable: true additionalProperties: false UserDetailResponseContentResponse: type: object properties: data: $ref: '#/components/schemas/UserDetailResponse' metadata: $ref: '#/components/schemas/ContentMetadataResponse' additionalProperties: false ValidationIssue: type: object properties: field: type: string reason: type: string reasonToken: type: string reasonTokenArguments: type: array items: $ref: '#/components/schemas/ValidationIssueArgument' nullable: true additionalProperties: false ObjectContentResponse: type: object properties: data: nullable: true metadata: $ref: '#/components/schemas/ContentMetadataResponse' additionalProperties: false ValidationIssueArgument: type: object properties: name: type: string value: nullable: true additionalProperties: false UserDetailResponse: type: object properties: user: $ref: '#/components/schemas/UserSummaryResponse' organisationIds: type: array items: type: string description: Every organisation they hold a direct grant on. coversWholeCustomer: type: boolean description: >- True when they also hold account-wide access, which reaches every organisation the account owns, including ones added later. When true, `organisationIds` is not the whole picture and is usually empty. additionalProperties: false description: 'One person in full: who they are, and everything they reach.' ContentMetadataResponse: type: object properties: dateFormat: type: string dateTimeFormat: type: string paginationToken: type: string nullable: true additionalProperties: false UserSummaryResponse: type: object properties: principalId: type: string description: >- The person's stable identifier on this platform. Address them with it on every `/users/{principalId}` route. email: type: string description: The address they sign in with. nullable: true givenName: type: string description: Their first name, as invited. nullable: true familyName: type: string description: Their last name, as invited. nullable: true accountState: enum: - unknown - invited - active - disabled type: string description: >- `invited` until they first sign in, `active` once they have, `disabled` when their sign-in has been switched off, and `unknown` when the identity directory could not be reached for this row. Somebody linked to an identity provider is `active` from the start: there is no invitation to accept. detailsAvailable: type: boolean description: >- False when the identity directory did not answer for this person. Their name and email address are then the last values stored and may be out of date or absent. The row is still returned. invitedDate: type: string description: When they were first given access to this account. nullable: true accessType: enum: - Customer - Guest type: string description: >- `Customer` for one of the account's own people; `Guest` for somebody from another business who reaches organisations here by invitation. A guest row shows only the access this account granted, and their account is not this account's to manage. signInProviders: type: array items: type: string description: >- The identity providers this person signs in through, by name. Empty or absent when they sign in with a password. nullable: true passwordSignIn: type: string description: >- `Denied` when they sign in through their identity provider alone: no temporary password was issued, the invitation cannot be resent, and there is nothing to reset. `Allowed` when they have a password. Absent on accounts created before sign-in was recorded. nullable: true additionalProperties: false description: One person in your account. securitySchemes: X-Auth-Token: type: apiKey description: FlowPayroll JWT (raw token, no Bearer prefix) name: X-Auth-Token in: header ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.