GET | List an LDAP server by [id]

Description

Access every attribute of one LDAP/AD server connection profile in the Segura™ platform. The response carries the server's current version in the ETag header, which the update endpoints require, and the actions available for the server in its current state.

Prerequisites

An application with the Users authorization granted by the administrator in A2A. For more information, access How to manage authorizations in A2A.
A valid OAuth 2.0 access token. For more information, access How to authenticate an application in A2A.

Request

GET /api/v2/iam/ldap-servers/{id}

Path parameters

Field	Type	Required	Description
`id`	integer	Yes	Unique identification code of the LDAP server. Note: this value is assigned by Segura™ in POST \| Create LDAP server.

Query parameters

Field	Type	Required	Description
`fields`	string	No	Comma-separated list of fields to return, such as `id,ldap_server.host,ldap_server.active`.

Headers

Header	Required	Description
`If-None-Match`	No	Version the client already holds. When it matches the server's current version, the response is `304 Not Modified` with no body.

Example request

GET {{url}}/api/v2/iam/ldap-servers/7

Response

HTTP/1.1 200 OK
ETag: "a3f8c2e1d9b04567"

The ETag header holds the server's current version. Keep the value: PUT | Update LDAP server by [id] and PATCH | Partially update LDAP server by [id] require it in the If-Match header to detect concurrent changes.

Example response body

{
    "data": {
        "id": 7,
        "ldap_server": {
            "host": "ad.example.com",
            "port": 389,
            "dn_base": "CN=Users,DC=example,DC=com",
            "active": true,
            "use_ssl": false,
            "member_is_dn": false,
            "bind_requires_dn": false,
            "account_form": "principal",
            "order": 1,
            "domain": { "id": 5, "name": "EXAMPLE.COM" },
            "bind_credential": {
                "id": 102,
                "username": "[email protected]",
                "domain": { "id": 5, "name": "EXAMPLE.COM" }
            },
            "network_connector": null,
            "account_filter_format": null,
            "use_credential_domain": false,
            "ignore_disabled_expired": false,
            "username_attribute": null,
            "dn_bind": null,
            "account_domain_name": "EXAMPLE.COM",
            "account_domain_name_short": "EXAMPLE",
            "group": null,
            "group_dn": null,
            "group_attribute": null,
            "group_scope": null,
            "group_filter": null,
            "member_attribute": null,
            "created_at": "2026-05-08T22:42:34+00:00",
            "updated_at": "2026-05-08T22:42:34+00:00"
        }
    },
    "meta": {
        "links": { "self": "/api/v2/iam/ldap-servers/7" },
        "actions": {
            "test-connection": "/api/v2/iam/ldap-servers/7/test-connection",
            "deactivate": "/api/v2/iam/ldap-servers/7/deactivate"
        }
    }
}

Response body fields

Info

From version 4.2.10, the response returns id and the id of each nested object as strings, for example "7". Request bodies still take these values as integers.

Field	Type	Description
`data`	object	The LDAP server.
`data.id`	integer	Unique identification code of the server, assigned by Segura™.
`data.ldap_server`	object	Attributes of the server.
`data.ldap_server.host`	string	Hostname or IP address of the directory server.
`data.ldap_server.port`	integer	Port the directory listens on.
`data.ldap_server.dn_base`	string	Base distinguished name for user searches.
`data.ldap_server.active`	boolean	Indicates whether the server is active.
`data.ldap_server.use_ssl`	boolean	Indicates whether LDAPS is enabled.
`data.ldap_server.member_is_dn`	boolean	Indicates that the member attribute returns a full distinguished name.
`data.ldap_server.bind_requires_dn`	boolean	Indicates that the directory requires a distinguished name to bind.
`data.ldap_server.account_form`	string	Username format the directory expects. Returns `dn`, `username`, `backslash`, `principal`, or `null`.
`data.ldap_server.order`	integer	Evaluation order in the authentication chain.
`data.ldap_server.domain`	object	Domain the server belongs to. Returns `null` when the stored domain name matches no registered domain.
`data.ldap_server.domain.id`	integer	Identification code of the domain.
`data.ldap_server.domain.name`	string	Name of the domain.
`data.ldap_server.bind_credential`	object	PAM credential used for the bind.
`data.ldap_server.bind_credential.id`	integer	Identification code of the credential.
`data.ldap_server.bind_credential.username`	string	Username of the credential.
`data.ldap_server.bind_credential.domain`	object	Domain of the credential.
`data.ldap_server.network_connector`	object	Network connector agent used to reach the server. Returns `null` when the server is reached directly.
`data.ldap_server.network_connector.id`	integer	Identification code of the network connector agent.
`data.ldap_server.network_connector.name`	string	Name of the network connector agent.
`data.ldap_server.account_filter_format`	string	Custom LDAP filter used to locate an account.
`data.ldap_server.use_credential_domain`	boolean	Indicates whether the domain of the bind credential is used.
`data.ldap_server.ignore_disabled_expired`	boolean	Indicates whether expired accounts are skipped during group synchronization.
`data.ldap_server.username_attribute`	string	Directory attribute holding the username.
`data.ldap_server.dn_bind`	string	Base path used for the bind operation.
`data.ldap_server.account_domain_name`	string	Domain name applied to accounts. Derived from the referenced domain and read-only.
`data.ldap_server.account_domain_name_short`	string	Short domain name applied to accounts. Derived from the referenced domain and read-only.
`data.ldap_server.group`	string	Group whose members are allowed to authenticate.
`data.ldap_server.group_dn`	string	Base distinguished name for group searches.
`data.ldap_server.group_attribute`	string	Directory attribute holding the group name.
`data.ldap_server.group_scope`	string	Scope of the group search. Returns `subtree`, `onelevel`, `base`, or `null`.
`data.ldap_server.group_filter`	string	LDAP filter applied when searching for groups.
`data.ldap_server.member_attribute`	string	Group attribute listing its members.
`data.ldap_server.created_at`	datetime	Date and time the server was created, in ISO 8601 format.
`data.ldap_server.updated_at`	datetime	Date and time the server was last changed, in ISO 8601 format.
`meta`	object	Resource metadata.
`meta.links`	object	Navigation links for the resource.
`meta.links.self`	string	Path of the server.
`meta.actions`	object	Actions available for the server in its current state.

Attention

meta.actions follows the server's state. An active server offers test-connection and deactivate; an inactive one offers test-connection and activate.

A server disabled through DELETE | Disable LDAP server by [id] is still readable. The request returns 200 OK with active set to false, not 404 Not Found.

Errors

HTTP code	Message	Possible cause	Solution
`401`	`api.auth.unauthorized`	The access token is missing or has expired.	Request a new access token.
`403`	`api.auth.forbidden`	The authorization does not have permission to read LDAP servers.	Ask the administrator to check the Users authorization in A2A, then generate a new token.
`404`	`api.resource.not_found`	The server does not exist.	Check the identification code sent in the path.
`422`	`api.validation.invalid_field`	`fields` names a field that does not exist.	Check the field names and resend the request.
`429`	`api.rate_limit.exceeded`	The request rate limit was exceeded.	Reduce the request rate and try again.

For authentication error messages and the 403 versus 404 policy, access API v2 - Conventions and shared behaviors.