Request Syntax URI Request Parameters Request Body Response Syntax Response Elements Errors Examples See Also

DescribeUser

Returns information about a specific user.

Request Syntax


POST /Users/DescribeUser?DirectoryId=DirectoryId HTTP/1.1
Content-type: application/json

{
   "OtherAttributes": [ "string" ],
   "Realm": "string",
   "SAMAccountName": "string"
}

URI Request Parameters

The request uses the following URI parameters.

DirectoryId

The identifier (ID) of the directory that's associated with the user.

Pattern: ^d-[0-9a-f]{10}$

Required: Yes

Request Body

The request accepts the following data in JSON format.

OtherAttributes

One or more attribute names to be returned for the user. A key is an attribute name, and the value is a list of maps. For a list of supported attributes, see Directory Service Data Attributes.

Type: Array of strings

Array Members: Minimum number of 1 item. Maximum number of 25 items.

Length Constraints: Minimum length of 1. Maximum length of 63.

Pattern: ^[A-Za-z*][A-Za-z-*]*$

Required: No

Realm

The domain name that's associated with the user.

Note

This parameter is optional, so you can return users outside your AWS Managed Microsoft AD domain. When no value is defined, only your AWS Managed Microsoft AD users are returned.

This value is case insensitive.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 255.

Pattern: ^([a-zA-Z0-9]+[\\.-])+([a-zA-Z0-9])+[.]?$

Required: No

SAMAccountName

The name of the user.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 20.

Pattern: ^[\w\-.]+$

Required: Yes

Response Syntax


HTTP/1.1 200
Content-type: application/json

{
   "DirectoryId": "string",
   "DistinguishedName": "string",
   "EmailAddress": "string",
   "Enabled": boolean,
   "GivenName": "string",
   "OtherAttributes": { 
      "string" : { ... }
   },
   "Realm": "string",
   "SAMAccountName": "string",
   "SID": "string",
   "Surname": "string",
   "UserPrincipalName": "string"
}

Response Elements

If the action is successful, the service sends back an HTTP 200 response.

The following data is returned in JSON format by the service.

DirectoryId

The identifier (ID) of the directory that's associated with the user.

Type: String

Pattern: ^d-[0-9a-f]{10}$

DistinguishedName

The distinguished name of the object.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 256.

EmailAddress

The email address of the user.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 256.

Enabled

Indicates whether the user account is active.

Type: Boolean

GivenName

The first name of the user.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 64.

OtherAttributes

The attribute values that are returned for the attribute names that are included in the request.

Note

Attribute names are case insensitive.

Type: String to AttributeValue object map

Map Entries: Maximum number of 25 items.

Key Length Constraints: Minimum length of 1. Maximum length of 63.

Key Pattern: ^[A-Za-z*][A-Za-z-*]*$

Realm

The domain name that's associated with the user.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 255.

Pattern: ^([a-zA-Z0-9]+[\\.-])+([a-zA-Z0-9])+[.]?$

SAMAccountName

The name of the user.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 20.

Pattern: ^[\w\-.]+$

SID

The unique security identifier (SID) of the user.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 256.

Surname

The last name of the user.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 64.

UserPrincipalName

The UPN that is an Internet-style login name for a user and is based on the Internet standard RFC 822. The UPN is shorter than the distinguished name and easier to remember.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 256.

Errors

For information about the errors that are common to all actions, see Common Errors.

AccessDeniedException

You don't have permission to perform the request or access the directory. It can also occur when the DirectoryId doesn't exist or the user, member, or group might be outside of your organizational unit (OU).

Make sure that you have the authentication and authorization to perform the action. Review the directory information in the request, and make sure that the object isn't outside of your OU.

HTTP Status Code: 403

DirectoryUnavailableException

The request could not be completed due to a problem in the configuration or current state of the specified directory.

HTTP Status Code: 400

InternalServerException

The operation didn't succeed because an internal error occurred. Try again later.

HTTP Status Code: 500

ResourceNotFoundException

The resource couldn't be found.

HTTP Status Code: 404

ThrottlingException

The limit on the number of requests per second has been exceeded.

HTTP Status Code: 429

ValidationException

The request isn't valid. Review the details in the error message to update the invalid parameters or values in your request.

HTTP Status Code: 400

Examples

Example

This example illustrates one usage of DescribeUser.

Sample Request


{
  "OtherAttributes": [
    "department",
    "manager",
    "ipPhone"
  ],
  "Realm": "examplecorp.com",
  "SAMAccountName": "twhitlock"
}

Sample Response


{
  "DirectoryId": "d-926example",
  "DistinguishedName": "Terry Whitlock",
  "EmailAddress": "terry.whitlock@examplecorp.com",
  "Enabled": true,
  "GivenName": "Terry Whitlock",
  "OtherAttributes": {
    "Department": {"S": "communications"},
    "Manager": {"S": "OU=Users,DC=mmajors"},
    "IpPhone": {"S": "111.111.111.111"}
  },
  "SAMAccountName": "twhitlock",
  "SID": "S-1-5-11-112",
  "Surname": "Whitlock",
  "UserPrincipalName": "terry.whitlock"
}