# UserInfo

Return claims about the authenticated end-user **by sending a Bearer access token in the `Authorization` header**. The token must be issued with the `openid` scope. For more information, see the [OIDC UserInfo spec](https://openid.net/specs/openid-connect-core-1_0.html#UserInfo). The set of claims returned is determined by the granted scopes and the `claims.userinfo` request parameter from the original authorization request.

Endpoint: GET /oidc/me

## Header parameters:

  - `Authorization` (string, required)
    Bearer access token, e.g. `Authorization: Bearer <access_token>`.

## Response 200 fields (application/json):

  - `sub` (string, required)
    Subject identifier — stable identifier for the end-user.

  - `tid` (string)
    Tenant identifier.

  - `email` (string)
    Primary email address.

  - `groups` (array)
    Groups the user belongs to.

  - `new_user` (boolean)
    Whether this user was just created during the originating authentication flow.

  - `webauthn` (object)
    WebAuthn-related claims for the user.

## Response 500 fields (application/json):

  - `message` (string, required)
    Example: Something went wrong - Internal server error

  - `error_code` (number, required)
    Example: 500