Session Inspection Endpoints

This doc covers the direct session-inspection surface:

  • /session/me

This is a public direct API contract on api.user.m7.org.

Public here still means authenticated:

  • the caller must already hold valid access material

Endpoint Summary

Route Typical caller What it does Notes
/session/me user.m7.org and session-aware first-party callers Returns metadata for the current authenticated principal. Handles both consumer-user and org-member access tokens.

/session/me

Purpose:

  • validate the current authenticated principal
  • return session lifetime plus principal metadata

Typical output includes:

  • for consumer-user tokens:
    • iat
    • expires_in
    • expires
    • user id
    • user rid
    • user name
    • user avatar
    • user role
  • for org-member tokens:
    • iat
    • expires_in
    • expires
    • org
    • client
    • groups
  • for both:
    • identity-provider type, vendor, and verified flags

Use this when:

  • the caller already has access material
  • the caller wants to inspect the currently authenticated principal

Current behavior:

  • consumer-user access tokens validate through the user auth path
  • org-member access tokens validate through the member auth path
  • application tokens are rejected on this endpoint
1