# Retrieve a user

**GET /users/{user}**

Read one public profile by `id` or by `username`. This is the whole
public shape of a person in Commune. Email addresses, notification
settings, saved articles and read state are never returned here: they
belong to the person, not to a key.



## Servers
- Production. There is no separate sandbox host.
: https://api.usecommune.com (Production. There is no separate sandbox host.
)


## Authentication methods
- Api key


## Parameters
### Headers

- **Commune-Version** (string(date))
  The contract version this request is written against, as a release date
  (`YYYY-MM-DD`). Omitting the header pins the request to the version that
  was current when the API key was issued, so an integration keeps working
  when a newer version ships. An unknown value answers `400` with
  `invalid_version`.


### Path parameters

- **user** (string)
  The user's `id` or their `username`, with or without a leading `@`.


### Query parameters

- **fields** (string)
  Comma separated allow list of top level properties to return on each
  object, so a client can trim a response it does not need in full. `id`
  and `object` are always returned. An unknown property name answers
  `400`. Properties omitted by an operation, such as `content` on any
  article list, cannot be brought back with `fields`.

  A trimmed body is a subset of the schema this operation declares, and a
  property that schema marks required is absent when it was not asked for.
  That is the point of the parameter, so a client that validates responses
  against the schema either sends no `fields` or relaxes `required`.



## Responses
### 200
The user.

#### Body: application/json (object)
- **object** (string)
  Always `user`.

- **id** (string)
  Stable identifier.

- **username** (string | null)
  The unique handle the profile resolves on at `/@{username}`. Null
  for an account that has not finished signing up.

- **display_name** (string | null)
  The name shown next to their messages and bylines.

- **avatar** (string(uri) | null)
  Profile picture. Commune falls back to a generated avatar when the
  person never set one, so this is rarely null in practice.


### 400
The request was malformed: an unknown query parameter, an unparseable
cursor, an unknown `expand` path, or an unrecognised `Commune-Version`.


#### Body: application/json (object)
- **error** (object)


### 401
No API key was presented, or the key is unknown, revoked or expired.

All four answer identically, down to the wording. Saying that a key was
revoked rather than never issued confirms to whoever is holding the
string that it was once real, which a legitimate caller does not need
and a thief should not get.

#### Headers

- **WWW-Authenticate** (string)
  The authentication scheme this API accepts. Always
  `Bearer realm="Commune API"`; there is no second scheme and no
  query-parameter fallback, because a credential that can travel in a
  URL ends up in access logs and referer headers.


#### Body: application/json (object)
- **error** (object)


### 404
No such resource, or the key is not allowed to know that it exists.
Commune answers `404` rather than `403` where distinguishing the two
would leak the existence of private content.


#### Body: application/json (object)
- **error** (object)


### 429
Too many requests. Back off and retry after the interval named by the
`Retry-After` response header.

#### Headers

- **Retry-After** (integer)
  Seconds to wait before retrying.


#### Body: application/json (object)
- **error** (object)


### 500
Something failed inside Commune. The request may be retried.

#### Body: application/json (object)
- **error** (object)



[Powered by Bump.sh](https://bump.sh)