# GET /api/v2/users/{user}

Read a user

- MCP id: users.show
- Scope: api:read:users
- Permission: users::read
- Rate cost: 1 unit, read bucket.
- Cache-Control: private, no-store

Returns one user.

The detail view adds `working_hours`; everything else is in both views. A caller without `users::read` gets `404`, never `403`: a `403` on an id confirms the id exists, so the two answers would enumerate the organisation's people. A service account is `404` for the same reason it is absent from the list. A soft-deleted user is `404` unless you pass `trashed=with`; `trashed=only` returns a departed user and 404s a current one, which makes it an existence probe for a sync client and nothing else. There is no restore action on this resource, and reading a trashed row needs only `users::read`.

## Parameters
- user (integer, path): The User's numeric id. Accepts a soft-deleted record.
- view (string, optional): Which field set to render.
- trashed (string, optional): Whether soft-deleted rows are included.
- X-Request-Id (header, optional): A correlation id of your own. It is recorded in our logs next to the server's request id but never returned: the response header always carries the server's id. A value that does not match the pattern is discarded silently, never rejected.
- If-None-Match (header, optional): The ETag a read is conditional on. A match is answered 304 with no body.

## Response 200
- id (integer, required): Unique identifier.
- name (string ≤ 255, required): Full name as shown throughout plnnrly. Searchable with `?q=`.
- email (string ≤ 255, required): Work email address, unique within the organisation. Searchable with `?q=`, which is the practical way to resolve a person to an id.
- color (string ≤ 255, required): The user's identifying colour, as a CSS colour string. Used by plnnrly's calendars and avatars; render it or ignore it.
- job_title (string ≤ 255, required): Job title, e.g. Project Manager.
- phone_number (string or null ≤ 255, required): Phone number as entered, in no normalised format.
- timezone (string or null ≤ 255, required): The user's own IANA timezone, e.g. Europe/Amsterdam. Null means the organisation's default applies. Every timestamp in this API is UTC regardless; this is the zone a client renders them in for this person.
- date_employed (date (YYYY-MM-DD) or null, required): First day of employment, or `null` where it was never recorded. A calendar date with no clock, so it is never converted to UTC.
- birthday (date (YYYY-MM-DD) or null, required): Date of birth, or `null` where it was never recorded.
- profitability_target_percentage (integer or null, required): Share of available hours this person is expected to bill, 1 to 100, or `null` where no target is set. Read by the profitability report; a user without a target is still reported on, just not judged against one.
- working_hours (array of object or null, required, detail only): The contracted working week, one entry per shift, in week order. A weekday may carry several entries (a split day is two ranges), and a weekday that is not worked simply has none. Null or empty means no schedule has been recorded.
- work_locations (object, required, detail only): Where the user usually works on each weekday, keyed monday through sunday. The stored pattern lists only the days away from the office, so a weekday it does not name reads as office here. A single day's override from the agenda is not reflected.
  - monday (string, required): Monday.
  - tuesday (string, required): Tuesday.
  - wednesday (string, required): Wednesday.
  - thursday (string, required): Thursday.
  - friday (string, required): Friday.
  - saturday (string, required): Saturday.
  - sunday (string, required): Sunday.
- created_at (timestamp (YYYY-MM-DDThh:mm:ssZ), required): Creation timestamp.
- updated_at (timestamp (YYYY-MM-DDThh:mm:ssZ), required): Last-write timestamp; use for incremental sync.
- deleted_at (timestamp (YYYY-MM-DDThh:mm:ssZ) or null, required): Soft-delete timestamp, `null` while the user is active.
- links (UserLinks, required)
  - self (url, required): The canonical URI of this record.

## Errors
- 403 forbidden-by-policy | insufficient-permission | insufficient-token-scope: Forbidden.
- 304 : Not modified.
- 400 idempotency-key-required | invalid-cursor | invalid-query-parameter | malformed-request | unsupported-parameter: Bad request.
- 401 token-expired | unauthenticated: Unauthenticated.
- 404 endpoint-not-found | resource-not-found: Not found.
- 406 not-acceptable: Not acceptable.
- 429 rate-limit-exceeded: Too many requests.
- 500 internal-error: Server error.
- 503 tenant-unavailable: Service unavailable.

## Example
```bash
curl -G \
  'https://<your-url>/api/v2/users/1' \
  --data-urlencode 'view=detail' \
  -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/json'
```