A valid request URL is required to generate request examples{
"user": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "<string>",
"email": "jsmith@example.com",
"avatar_url": "<string>",
"totp_enabled": true,
"password_breached": true
},
"active_organization_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"active_organization_code": "<string>",
"active_organization_name": "<string>",
"active_organization_logo": "<string>",
"onboarded": true,
"role": "<string>",
"permissions": [
"organization:update"
],
"two_factor_available": true,
"uploads_available": true,
"expires_at": "2023-11-07T05:31:56Z"
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}Read the current session
Who the caller is, where they are, and what they may do there — resolved in a single query, so it is safe as the first call on load.
“Where they are” can be nowhere: an account removed from its last organization answers 200 with the five organization fields null and permissions empty, rather than being refused. Branch on active_organization_code before routing into an organization.
two_factor_available and uploads_available describe the platform, not the organization: they are false when the server cannot offer two-factor or file storage.
A valid request URL is required to generate request examples{
"user": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "<string>",
"email": "jsmith@example.com",
"avatar_url": "<string>",
"totp_enabled": true,
"password_breached": true
},
"active_organization_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"active_organization_code": "<string>",
"active_organization_name": "<string>",
"active_organization_logo": "<string>",
"onboarded": true,
"role": "<string>",
"permissions": [
"organization:update"
],
"two_factor_available": true,
"uploads_available": true,
"expires_at": "2023-11-07T05:31:56Z"
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}Authorizations
A staff session token, uk_st_…. Minted by sign-up, sign-in or the two-factor exchange. Only a 401 means it is spent; not_a_member (403) is about the organization named in X-Organization-Id and leaves the token good for the others.
Headers
The organization the caller is acting on — the org_… code that appears in the panel URL. It identifies; the membership JOIN is what authorizes, so a forged code reads nothing: the answer is not_a_member (403), which does not mean the session is over. Absent, the session's default organization answers, or — if that membership was revoked while the session was open — any other one the caller still holds.
Response
The session.
Show child attributes
Show child attributes
Null when the session is in no organization — an account removed from its last one. The four fields below and role are null with it, and permissions is empty. Only GET /v1/organizations, POST /v1/organizations, this endpoint and POST /v1/session/logout answer in that state; everything else is not_a_member (403).
A fine-grained capability. The catalogue lives in Go; which role holds which lives in the database.
organization:update, organization:delete, members:read, members:write, roles:read, roles:manage, api_keys:read, api_keys:write, customers:read, customers:write A platform capability, not the organization's.
A platform capability, not the organization's.