# Objects

## [External User](/content/docs/apis/actions/objects#external-user/index.html)

- `externalId` _string_
  User id from the identity provider
- `externalIdpId` _string_
  ID of the identity provider
- `human`
  - `firstName` _string_
  - `lastName` _string_
  - `nickName` _string_
  - `displayName` _string_
  - `preferredLanguage` _string_
    In [RFC 5646](https://www.rfc-editor.org/rfc/rfc5646) format
  - `email` _string_
  - `isEmailVerified` _boolean_
  - `phone` _string_
  - `isPhoneVerified` _boolean_

## [metadata with value as bytes](/content/docs/apis/actions/objects#metadata-with-value-as-bytes/index.html)

- `key` _string_
- `value` Array of _byte_

## [metadata result](/content/docs/apis/actions/objects#metadata-result/index.html)

- `count` _number_
- `sequence` _number_
- `timestamp` _Date_
- `metadata` Array of [_metadata_](/content/docs/apis/actions/objects#metadata/index.html)

## [metadata](/content/docs/apis/actions/objects#metadata/index.html)

- `creationDate` _Date_
- `changeDate` _Date_
- `resourceOwner` _string_
- `sequence` _number_
- `key` _string_
- `value` _Any_

## [user grant](/content/docs/apis/actions/objects#user-grant/index.html)

A user grant is a role assignment for a user.

- `projectID` _string_
  Required. ID of the project for the role assignment.
- `projectGrantID` _string_
  Optional. If the role assignment is for a project grant, include projectGrantID
- `roles` Array of _string_
  Roles to assign to the user.

## [user](/content/docs/apis/actions/objects#user/index.html)

- `id` _string_
- `creationDate` _Date_
- `changeDate` _Date_
- `resourceOwner` _string_
- `sequence` _number_
  Unsigned 64-bit integer
- `state` _number_
  - 0: unspecified
  - 1: active
  - 2: inactive
  - 3: deleted
  - 4: locked
  - 5: suspended
  - 6: initial
- `username` _string_
- `loginNames` Array of _string_
- `preferredLoginName` _string_
- `human`

Set if User (Human)
  - `firstName` _string_
  - `lastName` _string_
  - `nickName` _string_
  - `displayName` _string_
  - `avatarKey` _string_
  - `preferredLanguage` _string_
    In [RFC 5646](https://www.rfc-editor.org/rfc/rfc5646) format
  - `gender` _number_
    - 0: unspecified
    - 1: female
    - 2: male
    - 3: diverse
  - `email` _string_
  - `isEmailVerified` _boolean_
  - `phone` _string_
  - `isPhoneVerified` _boolean_
- `machine`

Set if the user is a machine
  - `name` _string_
  - `description` _string_

## [human user](/content/docs/apis/actions/objects#human-user/index.html)

- `id` _string_
- `creationDate` _Date_
- `changeDate` _Date_
- `resourceOwner` _string_
- `sequence` _number_
- `state` _number_
  - 0: unspecified
  - 1: active
  - 2: inactive
  - 3: deleted
  - 4: locked
  - 5: suspended
  - 6: initial
- `username` _string_
- `loginNames` Array of _string_
- `preferredLoginName` _string_
- `profile`
  - `firstName` _string_
  - `lastName` _string_
  - `nickName` _string_
  - `displayName` _string_
  - `preferredLanguage` _string_
    In [RFC 5646](https://www.rfc-editor.org/rfc/rfc5646) format
- `email`
  - `email` _string_
  - `isEmailVerified` _boolean_
- `phone`
  - `phone` _string_
  - `isPhoneVerified` _boolean_

## [Auth Request](/content/docs/apis/actions/objects#auth-request/index.html)

This object contains context information about the request to the [authorization endpoint](/content/docs/apis/openidoauth/endpoints#authorization-endpoint/index.html).

- `id` _string_
- `agentId` _string_
- `creationDate` _Date_
- `changeDate` _Date_
- `browserInfo` _browserInfo_
  - `userAgent` _string_
  - `acceptLanguage` _string_
  - `remoteIp` _string_
- `applicationId` _string_
- `callbackUri` _string_
- `transferState` _string_
- `prompt` Array of _Number_
  - 0: not specified
  - 1: none
  - 2: login
  - 3: consent
  - 4: select_account
  - 5: create
- `uiLocales` Array of _string_
- `loginHint` _string_
- `maxAuthAge` _Number_
  Duration in nanoseconds
- `instanceId` _string_
- `request`
  - `oidc`
    - `scopes` Array of _string_
- `userId` _string_
- `userName` _string_
- `loginName` _string_
- `displayName` _string_
- `resourceOwner` _string_
- `requestedOrgId` _string_
- `requestedOrgName` _string_
- `requestedPrimaryDomain` _string_
- `requestedOrgDomain` _bool_
- `applicationResourceOwner` _string_
- `privateLabelingSetting` _Number_
  - 0: Unspecified
  - 1: Enforce project's policy
  - 2: Allow user's organization login policy
- `selectedIdpConfigId` _string_
- `linkingUsers` Array of [_ExternalUser_](/content/docs/apis/actions/objects#external-user/index.html)
- `passwordVerified` _bool_
- `mfasVerified` Array of _Number_
  - 0: OTP
  - 1: U2F
  - 2: U2F User verification
- `audience` Array of _string_
- `authTime` _Date_

## [HTTP Request](/content/docs/apis/actions/objects#http-request/index.html)

This object is based on the Golang struct [http.Request](https://pkg.go.dev/net/http#Request), some attributes are removed as not all provided information is usable in this context.

- `method` _string_
- `url` _string_
- `proto` _string_
- `contentLength` _number_
- `host` _string_
- `form` Map _string_ of Array of _string_
- `postForm` Map _string_ of Array of _string_
- `remoteAddr` _string_
- `headers` Map _string_ of Array of _string_

## [Claims](/content/docs/apis/actions/objects#claims/index.html)

This object represents [the claims](/content/docs/apis/openidoauth/claims/index.html) which will be written into the oidc token.

- `sub` _string_
- `name` _string_
- `email` _string_
- `locale` _string_
- `given_name` _string_
- `family_name` _string_
- `preferred_username` _string_
- `email_verified` _bool_
- `updated_at` _Number_

There could be additional fields depending on the settings of your [project](/content/docs/guides/manage/console/projects-overview#role-settings/index.html) and your [application](/content/docs/guides/manage/console/applications-overview#token-settings/index.html)

## [token actor](/content/docs/apis/actions/objects#token-actor/index.html)

This object represents the actor of a token, this is the party which obtained the token on behalf of the subject through [token exchange](/content/docs/guides/integrate/token-exchange#actor-token/index.html) or impersonation.
It corresponds to the [`act` claim](/content/docs/apis/openidoauth/claims/index.html) of the token and is `null` if the token has no actor.

- `userId` _string_
  The id of the user acting on behalf of the subject
- `issuer` _string_
  The issuer of the token the actor was authenticated with
- `actor` _token actor_
  The previous actor in the delegation chain, `null` if there is none

## [user grant list](/content/docs/apis/actions/objects#user-grant-list/index.html)

This object represents a list of user grants (role assignments) stored in ZITADEL.

- `count` _Number_
- `sequence` _Number_
- `timestamp` _Date_
- `grants` Array of
  - `id` _string_
  - `projectGrantId` _string_
    The id of the [project grant](/content/docs/guides/solution-scenarios/saas#project-grant/index.html)
  - `state` _Number_
    - 0: unspecified
    - 1: active
    - 2: inactive
    - 3: removed
  - `creationDate` _Date_
  - `changeDate` _Date_
  - `sequence` _Number_
  - `userId` _string_
  - `roles` Array of _string_
  - `userResourceOwner` _string_
    The id of the organization of the user
  - `userGrantResourceOwner` _string_
    The id of the organization, where the user was granted
  - `userGrantResourceOwnerName` _string_
    The name of the organization, where the user was granted
  - `projectId` _string_
  - `projectName` _string_
  - `getOrgMetadata()` [_metadataResult_](/content/docs/apis/actions/objects#metadata-result/index.html)
    Get the metadata of the organization where the user was granted