# Look up an account

> The platform.users.lookup operation: POST /api/v1/platform/users/lookup in the REST API and the platform_users_lookup tool in the MCP server.

Finds a person's Ownrecord account by email address or user ID (spec §6.2) and returns what platform staff need
before acting on it: the platform role, the last sign-in, whether it is disabled, and how many console sessions,
OAuth grants (apps and MCP clients the person connected) and organizations it has. Organizations are counted,
never listed: an organization's data needs a support-access grant (§39.2).

Give exactly one of `email` or `userId`. Platform admins and support staff.

## At a glance

- **REST:** `POST /api/v1/platform/users/lookup`
- **MCP tool:** `platform_users_lookup`
- **Operation ID:** `platform.users.lookup`
- **Scope:** Platform
- **Permission:** `platform:read`
- **Risk tier:** `read`
- **Dry run:** Not supported
- **Idempotency:** `Idempotency-Key` required
- **Modes:** Test and live
- **Authentication:** API key with the `platform:read` scope
- **Since:** M13

## Request

### Body

A JSON object (`Content-Type: application/json`):

| Field    | Type       | Required | Description                  |
| -------- | ---------- | -------- | ---------------------------- |
| `email`  | string     | No       | The account's email address. |
| `userId` | `usr_…` ID | No       | The account's user ID.       |

## Response

`200 OK` with a JSON object:

| Field           | Type                                                                      | Description                                                      |
| --------------- | ------------------------------------------------------------------------- | ---------------------------------------------------------------- |
| `object`        | `"platform_user"`                                                         |                                                                  |
| `id`            | `usr_…` ID                                                                |                                                                  |
| `email`         | string                                                                    |                                                                  |
| `name`          | string or null                                                            |                                                                  |
| `platformRole`  | one of `platform_admin`, `platform_tax_admin`, `platform_support` or null |                                                                  |
| `createdAt`     | date-time                                                                 |                                                                  |
| `lastLoginAt`   | date-time or null                                                         |                                                                  |
| `disabled`      | boolean                                                                   |                                                                  |
| `disabledAt`    | date-time or null                                                         |                                                                  |
| `sessions`      | integer                                                                   | Console sessions that exist now.                                 |
| `oauthGrants`   | integer                                                                   | OAuth clients (apps, MCP clients) the person granted access.     |
| `organizations` | integer                                                                   | Organizations the person is a member of (counted, never listed). |

## Examples

### By email address

```http
POST /api/v1/platform/users/lookup
Authorization: Bearer or_test_…
Idempotency-Key: 3f1c9a52-7d0e-4b8f-9a61-0c2d5e8b7f14
Content-Type: application/json

{
  "email": "ana@example.com"
}
```

Response (`200`):

```json
{
  "object": "platform_user",
  "id": "usr_01m5wvkry1e6w94sjxgme33fsc",
  "email": "ana@example.com",
  "name": "Ana Horvat",
  "platformRole": null,
  "createdAt": "2026-09-14T10:02:11.000Z",
  "lastLoginAt": "2026-11-02T18:40:05.000Z",
  "disabled": false,
  "disabledAt": null,
  "sessions": 2,
  "oauthGrants": 1,
  "organizations": 1
}
```

## Errors

| Code                                                                                     | HTTP status | When                                                                | What to do                                                                                           |
| ---------------------------------------------------------------------------------------- | ----------- | ------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- |
| [`resource_not_found`](https://ownrecord.io/docs/reference/errors.md#resource_not_found) | 404         | No account has this address or ID.                                  | Check the ID and that your credentials are scoped to the right organization, entity, brand and mode. |
| [`validation_failed`](https://ownrecord.io/docs/reference/errors.md#validation_failed)   | 400         | Neither or both of `email` and `userId` were given.                 | Fix the fields listed in `details.issues` and send the request again.                                |
| [`permission_denied`](https://ownrecord.io/docs/reference/errors.md#permission_denied)   | 403         | You aren't platform staff with read access to the platform console. | Ask an organization owner or admin for a role or scope that allows this action.                      |

It can also return these [common errors](https://ownrecord.io/docs/reference.md#common-errors): [`api_version_unsupported`](https://ownrecord.io/docs/reference/errors.md#api_version_unsupported), [`invalid_json`](https://ownrecord.io/docs/reference/errors.md#invalid_json), [`unsupported_media_type`](https://ownrecord.io/docs/reference/errors.md#unsupported_media_type), [`authentication_required`](https://ownrecord.io/docs/reference/errors.md#authentication_required), [`api_key_invalid`](https://ownrecord.io/docs/reference/errors.md#api_key_invalid), [`idempotency_key_required`](https://ownrecord.io/docs/reference/errors.md#idempotency_key_required), [`dry_run_not_supported`](https://ownrecord.io/docs/reference/errors.md#dry_run_not_supported), [`rate_limited`](https://ownrecord.io/docs/reference/errors.md#rate_limited), [`internal_error`](https://ownrecord.io/docs/reference/errors.md#internal_error).