GET/api/auth/whoami/{client_app_id}Authenticated

Get the signed-in user

Returns the complete, current UserData of the caller (reloaded from the database rather than taken from the token's claims). Besides the auth server's own session and access tokens it accepts the per-client-app refresh token cookie issued to client_app_id during the OAuth2 grant, so SDK clients can sync their current user without an auth server session. Browser callers from an origin registered for the app receive credentialed CORS headers on every response (401 included); an authenticated request from an unregistered origin is refused with 403. Answer OPTIONS for the CORS preflight.

operationId get_api_auth_whoami_client_app_idAuthentication

Authentication & permissionsAuthenticated

Any authenticated user

Accepted credentials: Client app session (refresh token cookie)cookie "refresh_token_<client_app_id>"
Auth server session (refresh token cookie)cookie "refresh_token_<auth_server_app_id>"
Access token (cookie)cookie "access_token_<auth_server_app_id>"
Access token (Bearer)Authorization: Bearer <JWT>
Who may call: Any authenticated user
Notes: Credentials are checked before the path parameter, so an unauthenticated caller always gets 401 whatever client_app_id it sent.

Path parameters

Name	Type	Description
client_app_id*	string	Client application whose session the caller holds

Responses

application/json

Property	Type	Description
success*	true
user*	object
uid*	string (uuid)
sub*	string (uuid)
email*	string (email)
email_verified	boolean
username	string	minLength: 3maxLength: 32pattern: ^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$
first_name	string	minLength: 1maxLength: 64pattern: ^[^\u0000-\u001F\u007F]*$
middle_name	string	minLength: 1maxLength: 64pattern: ^[^\u0000-\u001F\u007F]*$
last_name	string	minLength: 1maxLength: 64pattern: ^[^\u0000-\u001F\u007F]*$
display_name	string	minLength: 1maxLength: 64pattern: ^[^\u0000-\u001F\u007F]*$
admin	boolean
phone_number	string	minLength: 10maxLength: 15
phone_verified	boolean
disabled	boolean
service_account	boolean
created_at*	integer	exclusiveMinimum: 0
invite_code	string	minLength: 8maxLength: 64pattern: ^[A-Za-z0-9_-]+$

JSONExample

"success"true

"user"

"uid""123e4567-e89b-12d3-a456-426614174000"

"sub""123e4567-e89b-12d3-a456-426614174000"

"email""user@example.com"

"email_verified"true

"username""string"

"first_name""string"

"middle_name""string"

"last_name""string"

"display_name""string"

"admin"true

"phone_number""string"

"phone_verified"true

"disabled"true

"service_account"true

"created_at"1

"invite_code""string"

Example request

bashcurl

curl -X GET 'https://auth.schemavaults.com/api/auth/whoami/<client_app_id>' \
  -b 'refresh_token_<client_app_id>=<value>'

Authentication & permissionsAuthenticated

Path parameters

Responses

200The caller's user data

400The request failed validation (issues lists the offending fields) or was refused by the handler

401No valid session cookie, access token cookie or bearer access token was presented, or the token was revoked

403The account is disabled, or the request is authenticated but comes from an origin not registered for the app

500Failed to load the user

Example request