Who am I, and what may I do
GET
/api/v1/auth/me
The one-shot bootstrap call: the current manager, their roles, the resolved permission codes, and the tenant settings a client needs before it can render anything. Authenticated but not permission-gated, so any working credential reaches it.
For an API token, permissions is the INTERSECTION of the token's scope with its owner's live permissions, and is_admin is forced to false even when the owner is a tenant administrator. That is the authoritative answer to what the credential may do — gate your client on this array, not on the owner's role names. max_users null means unlimited; 0 means blocked, not unlimited.
نظرة سريعة
- المصادقة
- رمز موظّف أو جلسة