GET/api/auth/whoami/{client_app_id}Authenticated

Get the signed-in user

Returns the complete, current UserData of the caller (reloaded from the database rather than taken from the token's claims). Besides the auth server's own session and access tokens it accepts the per-client-app refresh token cookie issued to client_app_id during the OAuth2 grant, so SDK clients can sync their current user without an auth server session. Browser callers from an origin registered for the app receive credentialed CORS headers on every response (401 included); an authenticated request from an unregistered origin is refused with 403. Answer OPTIONS for the CORS preflight.

operationId get_api_auth_whoami_client_app_idAuthentication

Authentication & permissionsAuthenticated

Any authenticated user

Accepted credentials
Who may call
Any authenticated user
Notes
Credentials are checked before the path parameter, so an unauthenticated caller always gets 401 whatever client_app_id it sent. The client app's refresh token is accepted both as the refresh_token_<client_app_id> cookie and, for SDK clients that hold it outside a cookie, as Authorization: Bearer; either way it is decoded as a refresh token and must have been issued to client_app_id.

Path parameters

NameTypeDescription
client_app_id*string

Client application whose session the caller holds

Responses

application/json
PropertyTypeDescription
success*true
user*object
uid*string (uuid)
sub*string

OIDC subject <auth_server_app_id>|<uid>, matching the id_token, userinfo and introspection sub. A bare uuid (older auth servers) is accepted and upgraded.

email*string (email)
email_verifiedboolean
usernamestring

minLength: 3maxLength: 32pattern: ^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$

first_namestring

minLength: 1maxLength: 64pattern: ^[^\u0000-\u001F\u007F]*$

middle_namestring

minLength: 1maxLength: 64pattern: ^[^\u0000-\u001F\u007F]*$

last_namestring

minLength: 1maxLength: 64pattern: ^[^\u0000-\u001F\u007F]*$

display_namestring

minLength: 1maxLength: 64pattern: ^[^\u0000-\u001F\u007F]*$

adminboolean
phone_numberstring

minLength: 10maxLength: 15

phone_verifiedboolean
disabledboolean
service_accountboolean
created_at*integer

exclusiveMinimum: 0

invite_codestring

minLength: 8maxLength: 64pattern: ^[A-Za-z0-9_-]+$

JSONExample
"success"true
"user"
"uid""123e4567-e89b-12d3-a456-426614174000"
"sub""string"
"email""user@example.com"
"email_verified"true
"username""string"
"first_name""string"
"middle_name""string"
"last_name""string"
"display_name""string"
"admin"true
"phone_number""string"
"phone_verified"true
"disabled"true
"service_account"true
"created_at"1
"invite_code""string"

Example request

bashcurl
curl -X GET 'https://auth.schemavaults.com/api/auth/whoami/<client_app_id>' \
  -b 'refresh_token_<client_app_id>=<value>'
GET /api/auth/whoami/{client_app_id} | SchemaVaults Auth API