# Get user token

After the user authenticates with the identity provider, ESP redirects to the `final` URL with `sessionid` and `sessionkey` query parameters. Use this endpoint to exchange those parameters for a JWT containing the user's identity attributes.

Deprecated endpoint
The previous endpoint `/sslprotected/environment_name/getUser` is deprecated. Use the endpoint below instead.

For the full technical reference, see the [OpenAPI specification](/products/esp/openapi/get-user).

#### Endpoint


```
GET /api/secure/{environment_name}/getUser
```

#### Headers

| Name | Required | Description |
|  --- | --- | --- |
| `Esp-Api-Key` | Yes | API key for the environment. |


#### Path parameters

| Name | Type | Required | Description |
|  --- | --- | --- | --- |
| `environment_name` | string | Yes | The environment path provided by Namirial during the assessment phase (e.g. `myintegration`) |


#### Query parameters

| Name | Type | Required | Description |
|  --- | --- | --- | --- |
| `sessionid` | string | Yes | The user identifier returned as a query parameter in the redirect to the `final` URL after login |
| `sessionkey` | string | Yes | The session key returned as a query parameter in the redirect to the `final` URL after login |


#### Request example


```
GET /api/secure/myintegration/getUser?sessionid=<sessionid>&sessionkey=<sessionkey>
```

#### Response examples

The endpoint returns a signed [JWT](https://jwt.io/introduction) containing the user's identity attributes. You can inspect the token content using the [JWT debugger](https://jwt.io/#debugger-io).

**200 — SPID JWT payload example**


```json
{
  "dateOfBirth": "1980-01-01",
  "domicileMunicipality": "ANCONA",
  "domicileNation": "IT",
  "placeOfBirth": "A271",
  "expirationDate": "2030-09-10",
  "domicileStreetAddress": "via sample, 11",
  "familyName": "ROSSI",
  "mobilePhone": "00390000000000",
  "address": "via sample, 11 60120 ANCONA AN",
  "email": "m.rossi@example.com",
  "domicilePostalCode": "60120",
  "name": "MARIO",
  "countyOfBirth": "AN",
  "spidCode": "NAMI0000000000",
  "gender": "M",
  "fiscalNumber": "TINIT-RSSMRA80A01A271B",
  "domicileProvince": "AN",
  "digitalAddress": "",
  "idCard": "",
  "level": null,
  "reqId": "_e709d704aa3b47eda307203119a987ac",
  "assertionId": "_71ce2354dd3222a0db8477dcb1441fec"
}
```

**200 — CIE JWT payload example**


```json
{
  "dateOfBirth": "1980-01-01",
  "familyName": "ROSSI",
  "name": "MARIO",
  "fiscalNumber": "TINIT-RSSMRA80A01A271B",
  "reqId": "_e709d704aa3b47eda307203119a987ac",
  "assertionId": "_71ce2354dd3222a0db8477dcb1441fec"
}
```

#### Error codes

| HTTP Status | Error code | Error type | Solution |
|  --- | --- | --- | --- |
| `400` | — | Bad request | The `sessionid` or `sessionkey` parameter is missing or the session was not found |
| `401` | — | Unauthorized | The API key is missing. Include the `Esp-Api-Key` header |
| `403` | — | Forbidden | The API key is invalid or does not have access to this environment |
| `404` | — | Not found | The `environment_name` does not exist |