Skip to main content
GET
Error

Authorizations

Authorization
string
header
required

A staff session token, uk_st_…. Minted by sign-up, sign-in or the two-factor exchange.

Headers

X-Organization-Id
string

The organization the caller is acting on — the org_… code that appears in the panel URL. It identifies; the membership JOIN is what authorizes, so a forged code reads nothing. Absent, the session's default organization answers.

Response

The session.

user
object
active_organization_id
string<uuid>
active_organization_code
string
active_organization_name
string
active_organization_logo
string | null
onboarded
boolean
role
string
permissions
enum<string>[]

A fine-grained capability. The catalogue lives in Go; which role holds which lives in the database.

Available options:
organization:update,
organization:delete,
members:read,
members:write,
roles:read,
roles:manage,
api_keys:read,
api_keys:write,
customers:read,
customers:write
two_factor_available
boolean

A platform capability, not the organization's.

uploads_available
boolean

A platform capability, not the organization's.

expires_at
string<date-time>