Who the session is and what it may do
GET
/me
const url = 'https://quikstik-core.fly.dev/me';const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url https://quikstik-core.fly.dev/me \ --header 'Authorization: Bearer <token>'Session-only. scopes[] and role are the membership authorizer’s answer now (the same ones
POST /login/sessions and POST /login/refresh return), so the app stops deriving ownership
from GET /team.
Authorizations
Section titled “Authorizations”Responses
Section titled “Responses”The session’s identity and grants
Media typeapplication/json
object
actor_id
required
string format: uuid
tenant_id
required
string format: uuid
scopes
required
The effective permission tokens of the session’s membership, sorted (empty when the membership is not active).
Array<string>
role
required
The highest role the scopes imply. Open (see contracts/openapi/README.md); the app reads ownership here, not from GET /team.
string
Example generated
{ "actor_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "tenant_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "scopes": [ "example" ], "role": "example"}No, invalid or expired session