List RBAC Clients

GET /v1/endpoints/{uuid}/rbac/clients

List the RBAC clients (end users) that can authenticate to this endpoint. RBAC clients are the visitors of an authenticated endpoint — distinct from the account user who owns the endpoint and from account-level API keys. Each client has its own credentials (username/password, bearer token, or OAuth identity) and is assigned one or more roles via memberships.

The list shows which credential methods each client has configured (via boolean flags) and a last-seen timestamp to help admins spot stale or compromised accounts. Sensitive credential material (password hashes, token hashes, invite tokens) is never returned.

Path parameters

uuid string (uuid) Req
The endpoint's uuid from /endpoints.

Response (200 OK)

JSON array of client objects ([] when the endpoint has none):

uuid string (uuid)
The client's public id. Used in nested URLs (/rbac/clients/{client_uuid}) and in membership bodies (client_uuid).
identifier string
Stable identifier for the client (canonicalised: lowercased, trimmed). Often matches their email or username.
display_name, email, username string?
Human-readable fields. email populates from OAuth claims; username is set when password auth is used. Each is omitted when empty.
status string
invited | active | disabled | revoked. Disabled/revoked clients can't authenticate but their sessions/audit history is preserved.
has_password, has_token, has_oauth boolean
Which credential methods are configured. All false when the client only joined via invite and hasn't completed setup.
identities array<object>
Linked OAuth/SSO identities (provider, subject, endpoint_uuid, client_uuid, created_at). Omitted when none.
registration_source string?
admin (created via API), self (registered themselves where policy allows), invite, sso. Omitted when unset.
metadata object
Free-form JSON metadata stored with the client. Useful for tagging by department, team, etc. Omitted when empty.
last_seen_at datetime?
Most recent activity. Omitted when the client has never been seen.
created_at, updated_at datetime
RFC 3339 UTC.

Deprecated: until the sunset this response also carries the legacy integer id and *_id fields. Don't use them; read uuid and the *_uuid fields.

To see a client's role assignments, use /rbac/memberships; for sessions use /clients/{client_uuid}/sessions. They are not embedded in this list.

Errors

401 Unauthorized
Missing auth.
403 Forbidden
Caller lacks the endpoints:read permission in the active account.
404 Not Found
Endpoint doesn't exist or doesn't belong to the calling account.
Request
curl "https://api.ngris.com/v1/endpoints/019bb1e4-e785-77d2-9966-c3cff31d0a0e/rbac/clients" \ -H "X-API-KEY: <your_api_key>"
Python
from ngris import Ngris client = Ngris(api_key="<your_api_key>") for c in client.endpoint_rbac.list_clients("019bb1e4-e785-77d2-9966-c3cff31d0a0e"): print(f"{c['uuid']} {c['identifier']} ({c['status']})")
Response — 200 OK
[ { "uuid": "019b4b9d-d300-736b-8601-153b3d9f70ee", "identifier": "alice@example.com", "display_name": "Alice", "email": "alice@example.com", "username": "alice", "status": "active", "has_password": true, "has_token": false, "has_oauth": false, "registration_source": "admin", "metadata": {"team": "platform"}, "last_seen_at": "2026-04-29T11:00:00Z", "created_at": "2026-04-01T00:00:00Z", "updated_at": "2026-04-29T11:00:00Z" } ]
Was this helpful?
On this page
List RBAC Clients
Was this helpful?
Homepage Docs Dashboard Docs API Docs nvelox Dashboard