Read ONE record by its id. This is the difference with GET /externals, and the reason this route exists: the list groups records by normalised email address and only ever hands back the group’s REPRESENTATIVE (MIN(ID)). A companyId set on a record that is not the representative is therefore invisible in the list, by any query — this route is the only way to read it back.

The id is a varchar(40) produced by randomId(), NOT a ULID.

An unknown id, or one belonging to another school, answers 404 EXTERNAL_NOT_FOUND. The two are deliberately indistinguishable: saying "forbidden" would confirm the record exists in another tenant.

ARCHIVED records ARE returned here, unlike in the list. The list excludes them because it is a picker — offering a tutor the school retired would attach an apprentice to a dead record. This route picks nothing: the caller already holds the id, and PATCH /externals/:id already accepts those same records, so a 404 here would make one verb deny what the other writes to. The response does not currently say whether a record is archived.