# Identity

## Query Audit Log

 - [GET /v1/identity/audit](https://docs.synqly.com/api-reference/connectors/identity/identity_query_audit_log.md): Returns a list of Event objects from the token-linked audit log.

Operation ID: identity_query_audit_log

## Query Risk Events

 - [GET /v1/identity/risk-events](https://docs.synqly.com/api-reference/connectors/identity/identity_query_risk_events.md): Returns identity threat / risk events (for example Microsoft Entra Identity Protection risk detections for users), normalized to OCSF.

Operation ID: identity_query_risk_events

## Query Risky Users

 - [GET /v1/identity/risky-users](https://docs.synqly.com/api-reference/connectors/identity/identity_query_risky_users.md): Returns rolled-up risky user records (for example Microsoft Entra Identity Protection riskyUsers), each normalized to an OCSF Entity Management Read event.

Operation ID: identity_query_risky_users

## Query Users

 - [GET /v1/identity/users](https://docs.synqly.com/api-reference/connectors/identity/identity_query_users.md): Returns a list of User objects wrapped in the OCSF Entity Management event of type Read from the token-linked identity provider.

Operation ID: identity_query_users

## Get User

 - [GET /v1/identity/users/{userId}](https://docs.synqly.com/api-reference/connectors/identity/identity_get_user.md): Returns a User object wrapped in an OCSF Entity Management event of type Read from the token-linked identity provider. Depending 
on the providers offerings, this may include additional user information, such as the user's current groups, roles, and Identity Protection risk state (when the provider exposes it and the user has a risk record).

Operation ID: identity_get_user

## Query Groups

 - [GET /v1/identity/groups](https://docs.synqly.com/api-reference/connectors/identity/identity_query_groups.md): Returns a list of Group objects wrapped in the OCSF Entity Management event of type Read from the token-linked identity provider.

Operation ID: identity_query_groups

## Get Group

 - [GET /v1/identity/groups/{groupId}](https://docs.synqly.com/api-reference/connectors/identity/identity_get_group.md): Returns a Group object wrapped in an OCSF Entity Management event of type Read from the token-linked identity provider. Depending 
on the providers offerings, this may include additional group information, such as the roles assigned.

Operation ID: identity_get_group

## Get Group Members

 - [GET /v1/identity/groups/{groupId}/members](https://docs.synqly.com/api-reference/connectors/identity/identity_get_group_members.md): Returns list of User objects wrapped in an OCSF Entity Management event of type Read from the token-linked identity provider that are members in the group referenced by ID.

Operation ID: identity_get_group_members

## Enable User

 - [POST /v1/identity/users/{userId}/actions/enable](https://docs.synqly.com/api-reference/connectors/identity/identity_enable_user.md): Reenables a disabled user in the identity system based on user ID.

Operation ID: identity_enable_user

## Disable User

 - [POST /v1/identity/users/{userId}/actions/disable](https://docs.synqly.com/api-reference/connectors/identity/identity_disable_user.md): Disables a user in the identity system based on user ID.

Operation ID: identity_disable_user

## Force User Password Reset

 - [POST /v1/identity/users/{userId}/actions/force_reset_password](https://docs.synqly.com/api-reference/connectors/identity/identity_force_user_password_reset.md): Forces a user to reset their password before they can log in again.

Operation ID: identity_force_user_password_reset

## Expire All User Sessions

 - [POST /v1/identity/users/{userId}/actions/expire_all_sessions](https://docs.synqly.com/api-reference/connectors/identity/identity_expire_all_user_sessions.md): Logs a user out of all current sessions so they must log in again.

Operation ID: identity_expire_all_user_sessions

## Get User Picture

 - [GET /v1/identity/users/{userId}/picture](https://docs.synqly.com/api-reference/connectors/identity/identity_get_user_picture.md): {% admonition type="info" name="Pre-Release" %}
This operation is available for testing but may be unstable. Breaking
changes are unlikely but may still be necessary.

Please contact us before using this operation.
{% /admonition %}
Returns the profile picture for a user as binary image data. The Content-Type header indicates the image format (e.g., image/jpeg, image/png).

Operation ID: identity_get_user_picture