# getUser() returns 400 for certain special characters

**URL:** <https://devforum.okta.com/t/getuser-returns-400-for-certain-special-characters/28126>\
**Category:** API\
**Tags:** java\
**Created:** [May 7, 2024, 5:37pm UTC](https://devforum.okta.com/t/getuser-returns-400-for-certain-special-characters/28126 "2024-05-07T17:37:27Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![mdowman](https://avatars.discourse-cdn.com/v4/letter/m/ecccb3/32.png) [@mdowman](https://devforum.okta.com/u/mdowman)\
**Post date:** [May 7, 2024, 5:37pm UTC](https://devforum.okta.com/t/getuser-returns-400-for-certain-special-characters/28126/1 "2024-05-07T17:37:27Z")

</div>

I’m using the Java Okta SDK to create and retrieve users from our tenant. The tenant is configured such that the username has no restrictions on its format.  
There are multiple special characters that can be created using UserApi / UserBuilder but when retrieved using UserApi.getUser() a 400 (bad request) is thrown.  
So far in testing the following special characters can be included in a username but not retrieved:  
opening square bracket, closing square bracket, backslash  
There are others too but I’ve still got narrow down exactly which they are.

Some questions:

- Is there a reason for this behaviour?
- Is there a workaround/solution to solve this?
- Is there a definitive list of special characters that exhibit this behaviour?

---

<div class="post-metadata">

**Author:** ![nikitag](https://avatars.discourse-cdn.com/v4/letter/n/ce7236/32.png) [@nikitag](https://devforum.okta.com/u/nikitag)\
**Post date:** [May 14, 2024, 7:57am UTC](https://devforum.okta.com/t/getuser-returns-400-for-certain-special-characters/28126/2 "2024-05-14T07:57:19Z")

</div>

Hi @mdowman thanks for this, I am checking something on my side and shall update soon.

---

<div class="post-metadata">

**Author:** ![mdowman](https://avatars.discourse-cdn.com/v4/letter/m/ecccb3/32.png) [@mdowman](https://devforum.okta.com/u/mdowman)\
**Post date:** [June 12, 2024, 10:36am UTC](https://devforum.okta.com/t/getuser-returns-400-for-certain-special-characters/28126/3 "2024-06-12T10:36:13Z")

</div>

Hi @nikitag, any update on this? Thanks.

---

<div class="post-metadata">

**Author:** ![nikitag](https://avatars.discourse-cdn.com/v4/letter/n/ce7236/32.png) [@nikitag](https://devforum.okta.com/u/nikitag)\
**Post date:** [June 14, 2024, 11:00am UTC](https://devforum.okta.com/t/getuser-returns-400-for-certain-special-characters/28126/4 "2024-06-14T11:00:08Z")

</div>

Hi there,

As per our documentation [here](https://developer.okta.com/docs/reference/api/users/#request-parameters-2) - When fetching a user by `login` or `login shortname` , you should [URL encode (opens new window)](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding) the request parameter to ensure that special characters are escaped properly. Usernames with a `/` or `?` character can only be fetched by `id` due to URL issues with escaping the `/` and `?` characters.

For example when making the [manual API call](https://developer.okta.com/docs/reference/api/users/#get-user-with-login) we again do mention URL encoding will need to be done, when using special characters.

At the moment there is no definitive list we have of special characters which exhibit this behaviour. Something that will need to be tested.

What special characters are you using in your username? (apart from these which you already mention throw an error during getUser() - `\` , `[` , `]` )

---

<div class="post-metadata">

**Author:** ![mdowman](https://avatars.discourse-cdn.com/v4/letter/m/ecccb3/32.png) [@mdowman](https://devforum.okta.com/u/mdowman)\
**Post date:** [June 18, 2024, 2:40pm UTC](https://devforum.okta.com/t/getuser-returns-400-for-certain-special-characters/28126/5 "2024-06-18T14:40:51Z")

</div>

Hi @nikitag,

We are using the Java Okta SDK, in particular UserApi / UserBuilder. My understanding (& from testing) is that these classes handle the escape of special characters. I have a test program to test all special characters int the username (create + getUser + delete). All special characters work with the exception of:

```auto
LF CR / ; ? [] \ horizontal-ellipsis

```

Provisionally we are using all special characters so it would be good to know which ones are prohibited.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [July 18, 2024, 2:41pm UTC](https://devforum.okta.com/t/getuser-returns-400-for-certain-special-characters/28126/6 "2024-07-18T14:41:03Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.
