List Clients Endpoints

List RBAC Clients

GET /v1/endpoints/{id}/rbac/clients

List the RBAC clients (end users) that can authenticate to this endpoint. RBAC clients are the visitors of an authenticated endpoint — distinct from the account user who owns the endpoint and from account-level API keys. Each client has its own credentials (username/password, bearer token, or OAuth identity) and is assigned one or more roles via memberships.

The list shows which credential methods each client has configured (via boolean flags) and a last-seen timestamp to help admins spot stale or compromised accounts. Sensitive credential material (password hashes, token hashes, invite tokens) is never returned.

Path parameters

id string (uuid) Req

Endpoint UUID.

Response (200 OK)

JSON array of client objects:

id int64

Numeric client ID. Used in nested URLs.

identifier string

Stable identifier for the client (canonicalised: lowercased, trimmed). Often matches their email or username.

display_name, email, username string

Human-readable fields. email populates from OAuth claims; username is set when password auth is used.

status string

invited | active | disabled | revoked. Disabled/revoked clients can't authenticate but their sessions/audit history is preserved.

has_password, has_token, has_oauth boolean

Which credential methods are configured. All false when the client only joined via invite and hasn't completed setup.

identities array<object>

Linked OAuth/SSO identities (provider, subject). Omitted when none.

registration_source string

admin (created via API), self (registered themselves where policy allows), invite, sso.

metadata object

Free-form JSON metadata stored with the client. Useful for tagging by department, team, etc. Omitted when empty.

last_seen_at datetime?

Most recent activity. Omitted when the client has never been seen.

created_at, updated_at datetime

RFC 3339 UTC.

To see a client's role assignments, use /rbac/memberships; for sessions use /clients/{id}/sessions. They are not embedded in this list.

Errors

401 Unauthorized

Missing auth.

403 Forbidden

Caller lacks the endpoints:read permission in the active account.

404 Not Found

Endpoint doesn't exist or doesn't belong to the calling account.

Request
curl "https://api.ngris.com/v1/endpoints/<uuid>/rbac/clients" \
  -H "X-API-KEY: <your_api_key>"

Python
from ngris import Ngris

client = Ngris(api_key="<your_api_key>")
for c in client.endpoint_rbac.list_clients("<endpoint_uuid>"):
    print(f"#{c['id']} {c['identifier']} ({c['status']})")

Response — 200 OK
[
  {
    "id": 11,
    "identifier": "alice@example.com",
    "display_name": "Alice",
    "email": "alice@example.com",
    "username": "alice",
    "status": "active",
    "has_password": true,
    "has_token": false,
    "has_oauth": false,
    "registration_source": "admin",
    "metadata": {"team": "platform"},
    "last_seen_at": "2026-04-29T11:00:00Z",
    "created_at": "2026-04-01T00:00:00Z",
    "updated_at": "2026-04-29T11:00:00Z"
  }
]

PreviousOAuth Presets NextCreate Client

On this page

List RBAC Clients