---
title: Get external user
summary: Retrieves external-user data via the remote SecurityApi; this library never uses the returned data in an authorization decision.
status: draft
owner: Framework.NCore maintainers
last_reviewed: 2026-10-02
library: SAIF.NetCore.AuthService
reference_type: package
operation_id: OP-08
trigger: Caller code requests external-user data (sourced from EXT oracle tables by the remote service).
---

# Get external user

Retrieves external-user data via the remote SecurityApi; this library never uses the returned data in an authorization decision.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-08 |
| **Trigger** | Caller code requests external-user data (sourced from EXT oracle tables by the remote service). |
| **Inputs** | `userId`. |
| **Outputs** | `ExternalUser`, or a thrown `SecurityClientException`. |
| **Primary components** | `SecurityClient.GetExternalUser(userId)` |
| **Entry point** | `src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Clients/SecurityClient.cs` |

## Steps

1. `GET /v1/ExternalData/User/{userId}` through `HandleSecurityServiceGetResponse<ExternalUser>` ([BR-AUTH-011](../business-rules.md#br-auth-011-a-non-successful-securityapi-response-always-throws))
   - 1.1 Await the GET call.
   - 1.2 On success, return `result.GetResult<ExternalUser>()`.
   - 1.3 Otherwise, if `result.ErrorException` is present, throw `SecurityClientException(result.ErrorMessage, result.ErrorException)` (error with inner exception).
   - 1.4 Otherwise (no inner exception), throw `SecurityClientException(result.ErrorMessage)`.

   > **Origin**: Steps 1.1–1.4 are implemented in [Handle a Security API response](handle-a-security-api-response.md) (`SAIF.NetCore.AuthService`) and executed on behalf of this operation.

## Process flow

The following diagram visualizes this operation's control flow.

```mermaid
flowchart TD
    Start([GetExternalUser called]) --> Get["GET /v1/ExternalData/User/userId"]
    Get --> Success{IsSuccessful?}
    Success -->|Yes| Return([Return ExternalUser])
    Success -->|No| Throw([Throw SecurityClientException])
```

## Failure and edge-case behavior

- A non-success remote response throws `SecurityClientException`.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)

## Sources
- `src/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/SAIF.NetCore.AuthService/Clients/SecurityClient.cs`