Account directory

The account directory is a protected machine-to-machine resource. It returns only users assigned to the calling application and deliberately returns the same not-found response for missing and unassigned users.

Discover the resource

GET {API_BASE}/.well-known/oauth-protected-resource/api/v1/directory

The RFC 9728 response supplies the exact resource, authorization server, bearer method, and supported scopes.

Request a token

Use Client Credentials and the discovered resource:

curl -X POST "$TOKEN_ENDPOINT" \
  -u 'CLIENT_ID:CLIENT_SECRET' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=client_credentials' \
  --data-urlencode 'resource=DISCOVERED_DIRECTORY_RESOURCE' \
  --data-urlencode 'scope=users:read users:read:email'

Read an assigned user

GET /api/v1/directory/users/{user_id}
Authorization: Bearer {client_credentials_access_token}

users:read is required. users:read:email and users:read:phone reveal those fields and depend on users:read. The gateway validates token audience, grant type, live grant version, scopes, and the application's direct or role-derived user assignment.