Using

Returns the caller's own identity. Unlike every other endpoint under this tag, reachable by any authenticated caller — not admin-only (the `auth_layer` middleware whitelists this path, see `middleware.rs`).

applies to v0.5.1

GET

/store-api/auth/whoami

const url = 'https://example.com/store-api/auth/whoami';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://example.com/store-api/auth/whoami \
  --header 'Authorization: Bearer <token>'

Checked in order: auth.enabled = false → Disabled; a TrustedPeer (UDS peer authenticated by the kernel) → TrustedPeer; otherwise the Bearer key is resolved to its UserRecord → Admin/User. A 401 past the auth_layer middleware (which already validates the key) can only mean a middleware bug — fail-closed, analogous to enforce_sql_level.

Authorizations

bearer_auth

Responses

200

Caller identity — name (if any) and role

application/json

Caller identity. role is the only discriminator between the four cases — see whoami for the full mapping; name is null whenever no UserRecord backs the caller (TrustedPeer, Disabled).

object

name

string | null

role

required

"Admin", "User", or a pseudo-role: "TrustedPeer" (UDS peer authenticated by the kernel) or "Disabled" (auth.enabled = false).

string

Example ^generated

{
  "name": "example",
  "role": "example"
}

401

Missing or invalid API key

text/plain

string

Returns the caller's own identity. Unlike every other endpoint under this tag, reachable by any authenticated caller — not admin-only (the `auth_layer` middleware whitelists this path, see `middleware.rs`).

Authorizations

Responses

200

Example generated

401

Example ^generated