Who the bearer token belongs to. [`Caller`] does the work: it demands a real session (not open in public-dashboard mode, since an anonymous visitor has no identity to report).

GET

/api/v1/auth/me

curl --request GET \
  --url https://example.com/api/v1/auth/me \
  --header 'Authorization: Bearer <token>'

Authorizations

• bearer

Responses

200

The bearer holder’s role and username

Media typeapplication/json

The caller’s own identity.

object

role

required

Predefined roles, ordered least → most privileged.

string

Allowed values: viewer operator admin

scope

required

One of:

string

Unrestricted visibility.

string

Allowed values: All

object

Visibility limited to these group identifiers.

object

Groups

required

Visibility limited to these group identifiers.

Array<string>

unique items

username

required

string

Example

{
  "role": "viewer",
  "scope": "All"
}

401

No valid bearer token — closed even on a public dashboard

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}