---
schema_version: "1"
id: 61089a0edaeb39bddff6721316e0c64a6f59ffa0154c9db22e67cd2db50fa0dd
title: Identity URLs
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/remoteaccess_using_openid.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_using_openid.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 6e861bb154ee2e9e007ad84c5fd293cc627482fbddc9ae8db7022921b041b617
description: The identity URL is the gateway to the Salesforce Identity Service that can be accessed using the OAuth 2.0 user-agent or web server flows. In these flows, when a connected app with the id scope is successfully authorized, it receives an identity URL along with the access token. The connected app can then send a GET request with the access token to the identity URL. In response, Salesforce returns details about the queried user and org.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Identity URLs

The identity URL is the gateway to the Salesforce Identity Service that can be accessed using the OAuth 2.0 user-agent or web server flows. In these flows, when a connected app with the `id` scope is successfully authorized, it receives an identity URL along with the access token. The connected app can then send a GET request with the access token to the identity URL. In response, Salesforce returns details about the queried user and org.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>All</strong> Editions</td></tr></tbody></table>

The Identity URL is returned in the `id` scope parameter. For example, `https://login.salesforce.com/id/00Dx0000000BV7z/005x00000012Q9P`.

The identity URL is also a RESTful API to query for additional information about users, such as their username, email address, and org ID. It also returns endpoints that the client can talk to, such as photos for profiles and accessible API endpoints.

## Client Access

Client access to the identity URL for one user doesn’t provide the same identity URL access to another user in the same org unless the associated token meets these conditions.

- The OAuth request for the access token includes the `full` or `api` scope.
- The access token is for a user with the API Enabled permission.
- The access token is for a user who has access to the other user according to the user sharing rules of the org.
- The access token is for an internal user, meaning the user\_type value in the response is `STANDARD`.

Otherwise, an access token for each user is required to view the user’s identity URL.

The format of the URL is https://login.salesforce.com/id/orgID/userID, where orgId is the ID of the Salesforce org that the user belongs to and userID is the Salesforce user ID.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note For a [sandbox](https://help.salesforce.com/s/articleView?id=platform.create_test_instance.htm&type=5&language=en_US), login.salesforce.com is replaced with test.salesforce.com. For an Experience Cloud site, login.salesforce.com is replaced with the site’s URL, such as MyDomainName.my.site.com/.well-known/openid-configuration. The URL must be HTTPS.

## Identity URL Request Parameters

You can use the following parameters with the access token and identity URL. You can use the access token in an authorization request header or a request with the `oauth_token` parameter.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:30%">
          <col style="width:70%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d62178e168">Parameter</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d62178e171">Description</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e168 ">
              <span id="remoteaccess_using_openid__access_token"><a name="remoteaccess_using_openid__access_token"><!-- --></a>
                <samp class="parmname">oauth_token</samp>
              </span>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e171 ">OAuth token that a connected app uses to request access to a protected
              resource on behalf of the client application. Additional permissions in the form of
              scopes can accompany the access token.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e168 ">
              <samp class="parmname">format</samp>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e171 ">
              <p>Optional. Specify the format of the returned output. Values are: </p>
              <ul>
                <li><code>json</code></li>
                <li><code>xml</code></li>
              </ul>
              <p>The client can also specify the returned format in an accept-request
                header using one of the following formats.</p>
              <ul>
                <li><code>Accept: application/json</code></li>
                <li><code>Accept: application/xml</code></li>
                <li><code>Accept:
                            application/x-www-form-urlencoded</code></li>
              </ul>
              <p>The request header also supports the following.</p>
              <ul>
                <li>The <code>*/*</code> wildcard is accepted and
                  returns JSON.</li>
                <li>A list of values, which is checked left to right. For example: <code>application/xml,application/json,application/html,*/*</code> returns
                  XML.</li>
              </ul>
              <p style="margin-bottom:0;">The <code>format</code> parameter takes
                precedence over the access request header.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e168 ">
              <samp class="parmname">version</samp>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e171 ">Optional. Specify a SOAP API version number or the literal string <code>latest</code>. If this value isn’t specified, the returned
              API URLs contain the literal value <code>{version}</code>
              in place of the version number. If the value is specified as <code>latest</code>, the most recent API version is
              used.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e168 ">
              <samp class="parmname">PrettyPrint</samp>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e171 ">Optional. Accepted only in a header and not as a URL parameter. Specify this
              parameter to optimize the returned XML or JSON output for readability rather than
              size. For example, use the following in a header: <code>X-PrettyPrint:1</code>. </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e168 ">
              <samp class="parmname">callback</samp>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e171 ">
              <p>Optional. Specify a valid JavaScript function name. You can use this
                parameter when the specified format is JSON. The output is wrapped in this
                function name (JSONP). For example, if a request to
                <samp class="filepath">https://server/id/orgid/userid/</samp> returns <code>{"function":"name"}</code>, a request to
                <samp class="filepath">https://server/id/orgid/userid/?callback=baz</samp> returns
                <code>baz({"function":"name"});</code>.
              </p>
              <div class="slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium">
                <div class="slds-media slds-media_responsive">
                  <div class="slds-media__figure"><span class="slds-icon_container slds-icon_container_circle slds-icon-note-note"><img style="margin-bottom:0;" src="https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png" alt="Note"></span></div>
                  <div class="slds-media__body" style="padding-top:.5rem;padding-bottom:.5rem;"><span class="slds-text-title_caps">Note</span> JSONP is no
                    longer returned for Identity Service requests due to strict MIME typing. Your
                    requests must add <code>'format=jsonp'</code>
                    with the callback parameter so that the Identity Service returns JavaScript.
                    When the Identity Service detects the JSONP format, it returns the required
                    JavaScript type (<code>'application/javascript'</code>).</div>
                </div>
              </div>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e168 ">
              <samp class="parmname">is_salesforce_integration_user</samp>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e171 ">Optional. Specify this parameter to determine if the user has the
              Salesforce Integration user license.</td>

          </tr>
        </tbody>
      </table>

## Identity URL Response

With a successful request, the identity URL response returns information about the queried user and org.

The following identity URL response is in XML format.

```
<?xml version="1.0" encoding="UTF-8"?>
<user xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<id>https://MyDomainName.my.salesforce.com/id/00Dx000.../005x000...</id>
<asserted_user>true</asserted_user>
<user_id>005x000000...</user_id>
<organization_id>00Dx000...</organization_id>
<nick_name>admin1.2777578168398293E12...</nick_name>
<display_name>Alan Van</display_name>
<email>admin@mycompany.com</email>
<status>
   <created_date xsi:nil="true"/>
   <body xsi:nil="true"/>
</status>
<photos>
   <picture>https://MyDomainName--03925205UAF.file.force-user-content.com</picture>
   <thumbnail>https://MyDomainName--03925205UAF.file.force-user-content.com</thumbnail>
</photos>
<urls>
   <enterprise>https://MyDomainName.my.salesforce.com/services/Soap/c/{version}/00Dx000...</enterprise>
   <metadata>https://MyDomainName.my.salesforce.com/services/Soap/m/{version}/00Dx000...</metadata>
   <partner>https://MyDomainName.my.salesforce.com/services/Soap/u/{version}/00Dx000...</partner>
   <rest>https://MyDomainName.my.salesforce.com/services/data/v{version}/
   </rest>
   <sobjects>https://MyDomainName.my.salesforce.com/services/data/v{version}/sobjects/
   </sobjects>
   <search>https://MyDomainName.my.salesforce.com/services/data/v{version}/search/
   </search>
   <query>https://MyDomainName.my.salesforce.com/services/data/v{version}/query/
   </query>
   <profile>https://MyDomainName.my.salesforce.com/005x000...</profile>
</urls>
<active>true</active>
<user_type>STANDARD</user_type>
<language>en_US</language>
<locale>en_US</locale>
<utcOffset>-28800000</utcOffset>
<last_modified_date>2021-04-28T20:54:09.000Z</last_modified_date>
</user>
```

And this response is in JSON format.

```
{"id":"https://MyDomainName.my.salesforce.com/id/00Dx000.../005x000...",
"asserted_user":true,
"user_id":"005x000...",
"organization_id":"00Dx000...",
"nick_name":"admin1.2777578168398293E12...",
"display_name":"Alan Van",
"email":"admin@mycompany.com",
"status":{"created_date":null,"body":null},
"photos":{"picture":"https://MyDomainName--03925205UAF.file.force-user-content.com",
   "thumbnail":"https://MyDomainName--03925205UAF.file.force-user-content.com"},
"urls":
   {"enterprise":"https://MyDomainName.my.salesforce.com/services/Soap/c/{version}/00Dx000...",
   "metadata":"https://MyDomainName.my.salesforce.com/services/Soap/m/{version}/00Dx000...",
   "partner":"https://MyDomainName.my.salesforce.com/services/Soap/u/{version}/00Dx000...",
   "rest":"https://MyDomainName.my.salesforce.com/services/data/v{version}/",
   "sobjects":"https://MyDomainName.my.salesforce.com/services/data/v{version}/sobjects/",
   "search":"https://MyDomainName.my.salesforce.com/services/data/v{version}/search/",
   "query":"https://MyDomainName.my.salesforce.com/services/data/v{version}/query/",
   "profile":"https://MyDomainName.my.salesforce.com/005x000..."},
"active":true,
"user_type":"STANDARD",
"language":"en_US",
"locale":"en_US",
"utcOffset":-28800000,
"last_modified_date":"2021-04-28T20:54:09.000+0000"}
```

This table describes the returned parameters.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:30%">
          <col style="width:70%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d62178e429">Parameter</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d62178e432">Description</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>id</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">Identity URL, which is the same URL that was queried.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>asserted_user</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">Boolean value indicating whether the specified access token was issued for
              this identity.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>user_id</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">User ID of the queried user.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>username</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">Username of the queried user.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>organization_id</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">ID of the queried user’s Salesforce org.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>nick_name</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">Experience Cloud nickname of the queried user.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>display_name</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">Display name (full name) of the queried user.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>email</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">Email address of the queried user.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>email_verified</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">
              <p>Indicates whether the queried user’s email was verified by clicking a link in
                the “Welcome to Salesforce” email.</p>
              <p>The <samp class="parmname">email_verified</samp> value
                is set to <code>true</code> when users click a link in
                the email they receive after the following:For example, a Salesforce admin creates the user Roberta Smith. Roberta
                receives a “Welcome to Salesforce” email message with a link to verify her
                account. After she clicks the link, the <samp class="parmname">email_verified</samp>
                value is set to <code>true</code>.</p>
              <ul>
                <li>They change their email address</li>
                <li>They change their password, or a Salesforce admin resets their
                  password</li>
                <li>They verify their identity when logging in from a new device or
                  browser</li>
                <li>A Salesforce admin creates them as a new user</li>
              </ul>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>first_name</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">First name of the queried user.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>last_name</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">Last name of the queried user.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>timezone</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">Time zone specified in the queried user’s settings</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>photos</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">
              <p>Map of URLs to the queried user’s profile pictures, specified as <code>picture</code> or <code>thumbnail</code>.</p>
              <div class="slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium">
                <div class="slds-media slds-media_responsive">
                  <div class="slds-media__figure"><span class="slds-icon_container slds-icon_container_circle slds-icon-note-note"><img style="margin-bottom:0;" src="https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png" alt="Note"></span></div>
                  <div class="slds-media__body" style="padding-top:.5rem;padding-bottom:.5rem;"><span class="slds-text-title_caps">Note</span> Accessing these URLs requires passing an access token.
                    See <a href="https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_using_openid.htm&amp;release=264.0.0&amp;type=5">access
                      token</a>.</div>
                </div>
              </div>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>addr_street</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">Street specified in the address of the queried user’s settings.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>addr_city</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">City specified in the address of the queried user’s settings.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>addr_state</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">State specified in the address of the queried user’s settings.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>addr_country</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">Country specified in the address of the queried user’s settings.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>addr_zip</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">Zip or postal code specified in the address of the queried user’s
              settings.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>mobile_phone</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">Mobile phone number specified in the queried user’s settings.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>mobile_phone_verified</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">Queried user confirmed that the mobile phone number is valid,</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>status</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">
              <p>Queried user’s current Chatter status.</p>
              <ul>
                <li><code>created_date</code>—<code>xsd datetime</code> value of the creation date of the
                  last post by the user, for example, 2010-05-08T05:17:51.000Z.</li>
                <li><code>body</code>—Body of the post.</li>
              </ul>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>urls</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">
              <p>Map containing various API endpoints that can be used with the queried user
              </p>
              <div class="slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium">
                <div class="slds-media slds-media_responsive">
                  <div class="slds-media__figure"><span class="slds-icon_container slds-icon_container_circle slds-icon-note-note"><img style="margin-bottom:0;" src="https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png" alt="Note"></span></div>
                  <div class="slds-media__body" style="padding-top:.5rem;padding-bottom:.5rem;"><span class="slds-text-title_caps">Note</span> Accessing the REST endpoints requires passing an access token. See <a href="https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_using_openid.htm&amp;release=264.0.0&amp;type=5">access token</a>.</div>
                </div>
              </div>
              <ul>
                <li><code>enterprise</code> (SOAP)</li>
                <li><code>metadata</code> (SOAP)</li>
                <li><code>partner</code> (SOAP)</li>
                <li><code>rest</code> (REST)</li>
                <li><code>sobjects</code> (REST)</li>
                <li><code>search</code> (REST)</li>
                <li><code>query</code> (REST)</li>
                <li><code>recent</code> (REST)</li>
                <li><code>profile</code></li>
                <li><code>feeds</code> (Chatter)</li>
                <li><code>feed-items</code> (Chatter)</li>
                <li><code>groups</code> (Chatter)</li>
                <li><code>users</code> (Chatter)</li>
                <li><code>custom_domain</code>
                  <div class="slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium">
                    <div class="slds-media slds-media_responsive">
                      <div class="slds-media__figure"><span class="slds-icon_container slds-icon_container_circle slds-icon-note-note"><img style="margin-bottom:0;" src="https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png" alt="Note"></span></div>
                      <div class="slds-media__body" style="padding-top:.5rem;padding-bottom:.5rem;"><span class="slds-text-title_caps">Note</span> If the org doesn’t
                        have a custom domain configured and propagated, this value is
                        omitted.</div>
                    </div>
                  </div>
                </li>
              </ul>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>active</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">Boolean specifying whether the queried user is active.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>user_type</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">Type of the queried user.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>language</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">Language of the queried user.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>locale</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">Locale of the queried user.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>utcOffset</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">Offset from UTC of the queried user’s time zone, in milliseconds.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>last_modified_date</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 "><code>xsd datetime</code> format of the last
              modification of the user, for example, 2010-06-28T20:54:09.000Z.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>is_app_installed</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">Value is <code>true</code> when the connected app is
              installed in the user’s org, and the user’s access token was created using an
              OAuth flow. If the connected app isn’t installed, the response doesn’t contain
              this value. When parsing the response, check for the existence and value of this
              property.</td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>mobile_policy</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">
              <p>Specific values for managing a mobile connected app. These values are
                available only when the connected app is installed in the current user’s org, the
                app has a defined session timeout value, and the mobile PIN has a length value defined.</p>
              <ul>
                <li><code>screen_lock</code>—Length of time to
                  wait to lock the screen after inactivity.</li>
                <li><code>pin_length</code>—Length of the
                  identification number required to gain access to the mobile app.</li>
              </ul>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>push_service_type</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">
              <p>Set to <code>apple</code> if the connected app is
                registered with Apple Push Notification Service (APNS) for iOS push notifications.
                Set to <code>androidGcm</code> if it’s registered with
                Google Cloud Messaging (GCM) for Android push notifications. </p>
              <p style="margin-bottom:0;">The response value
                type is an array.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Parameter" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e429 ">
              <code>custom_permissions</code>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d62178e432 ">
              <p>
                <span id="remoteaccess_using_openid__custom_perm_scope_desc"><a name="remoteaccess_using_openid__custom_perm_scope_desc"><!-- --></a>When a request includes the <code>custom_permissions</code> scope parameter, the response
                  includes a map containing custom permissions in the org associated with the
                  connected app. If the connected app isn’t installed in the org or has no
                  associated custom permissions, the response doesn’t contain a <code>custom_permissions</code> map.</span>
              </p>
              <div>
                <p>Here’s an example
                  request.</p>
                <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code>http://<var>MyDomainName</var>.my.salesforce.com/services/oauth2/authorize?response_type=token&amp;client_
                    id=3MVG9lKcPoNINVBKV6EgVJiF.snSDwh6_2wSS7BrOhHGEJkC_&amp;redirect_uri=http://www.example.org/qa/security/oauth
                    /useragent_flow_callback.jsp&amp;scope=api%20id%20custom_permissions
                  </code></pre>
              </div>
              <div>
                <p>Here’s
                  the JSON block in the identity URL
                  response.</p>
                <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code>"custom_permissions":
                      {
                      "Email.View":true,
                      "Email.Create":false,
                      "Email.Delete":false
                      }
                    </code></pre>
              </div>
            </td>

          </tr>
        </tbody>
      </table>

## Potential Errors

After making an invalid request, the following errors are possible responses from Salesforce.

 
| Error Code | Request Problem |
| --- | --- |
| 403 (forbidden) — HTTPS\_Required | HTTP |
| 403 (forbidden) — Missing\_OAuth\_Token | Missing access token |
| 403 (forbidden) — Bad\_OAuth\_Token | Invalid access token |
| 403 (forbidden) — Wrong\_Org | User is in a different org |
| 404 (not found) — Bad\_Id | Invalid or bad user or org ID |
| 404 (not found) — Inactive | Deactivated user or inactive org |
| 404 (not found) — No\_Access | User lacks proper access to org or information |
| 404 (not found) — No\_Site\_Endpoint | Request to an invalid endpoint of a site |
| 404 (not found) — Internal Error | No response from server |
| 406 (not acceptable) — Invalid\_Version | Invalid version |
| 406 (not acceptable) — Invalid\_Callback | Invalid callback |

#### See Also

- [OAuth Tokens and Scopes](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_tokens_scopes.htm&release=264.0.0&type=5 "OAuth tokens authorize access to protected resources. Connected apps receive tokens on behalf of a client after authorization. Scopes further define the type of protected resources that the connected app can access. You assign scopes to a connected app when you build it, and they’re included with the OAuth tokens during the authorization flow.")
- [Edit Users](https://help.salesforce.com/s/articleView?id=platform.editing_users.htm&type=5&language=en_US)