{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/karmacheck/json-schema/karmacheck-user-get-user-by-group-internal-schema.json",
  "title": "User (Internal)",
  "description": "This model represents a User entity that is returned by the Get Users By Group Profile API.",
  "x-generated": "2026-11-09",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/karmacheck-users-api-openapi.yml#/components/schemas/UserGetUserByGroupInternal",
  "type": "object",
  "required": [
    "id",
    "givenName",
    "familyName",
    "enabled"
  ],
  "properties": {
    "id": {
      "type": "string"
    },
    "givenName": {
      "type": "string"
    },
    "familyName": {
      "type": "string"
    },
    "enabled": {
      "type": "integer",
      "enum": [
        1,
        0
      ],
      "description": "A boolean integer: 1 (true) if the user's account is enabled in KarmaCheck; 0 (false) if the user account is disabled. By default, all users are returned. Control by passing `includeDisabled=true|false` as a query param."
    },
    "username": {
      "type": "string",
      "format": "email",
      "description": "Not returned by default. Control by passing `includeEmail=true|false` as a query param."
    },
    "mfa": {
      "type": "object",
      "description": "Not returned by default. Control by passing `includeMfa=true|false` as a query param.",
      "required": [
        "enrollments"
      ],
      "properties": {
        "enrollments": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MFAEnrollment"
          }
        }
      }
    }
  },
  "$defs": {
    "MFAEnrollment": {
      "type": "object",
      "title": "MFA Enrollment",
      "required": [
        "id",
        "crStamp",
        "modStamp",
        "label",
        "method",
        "status"
      ],
      "properties": {
        "id": {
          "type": "string",
          "description": "A unique ID associated with the MFA enrollment."
        },
        "crStamp": {
          "type": "string",
          "format": "date-time",
          "description": "The UTC timestamp when the MFA enrollment was created."
        },
        "modStamp": {
          "type": "string",
          "format": "date-time",
          "description": "The UTC timestamp when the MFA enrollment was last modified."
        },
        "activatedStamp": {
          "type": "string",
          "format": "date-time",
          "description": "The UTC timestamp when the MFA enrollment was activated."
        },
        "lastUsedStamp": {
          "type": "string",
          "description": "The UTC timestamp when the MFA enrollment was last used for a verification attempt.",
          "format": "date-time"
        },
        "lastVerifiedStamp": {
          "type": "string",
          "format": "date-time",
          "description": "The UTC timestamp when a challenge against this MFA enrollment was last verified."
        },
        "label": {
          "type": "string",
          "minLength": 1,
          "maxLength": 64,
          "description": "The human-friendly label associated with the MFA enrollment.",
          "default": "Device"
        },
        "method": {
          "enum": [
            "totp"
          ],
          "description": "The MFA enrollment method, such as time-based one-time password."
        },
        "status": {
          "enum": [
            "active",
            "revoked",
            "pending"
          ],
          "description": "The current status of the MFA enrollment."
        },
        "revokedBy": {
          "type": "object",
          "description": "Details about the MFA enrollment's revocation, if its status is \"revoked\".",
          "required": [
            "id",
            "username",
            "revokedStamp"
          ],
          "properties": {
            "id": {
              "type": [
                "string",
                "null"
              ],
              "description": "The ID of the user that revoked the MFA enrollment."
            },
            "username": {
              "type": [
                "string",
                "null"
              ],
              "description": "The username of the user that revoked the MFA enrollment."
            },
            "revokedStamp": {
              "type": "string",
              "format": "date-time",
              "description": "The UTC timestamp when the MFA enrollment was revoked."
            }
          }
        }
      }
    }
  }
}