Session

Inspect authenticated operator, scopes, and bearer token context.

Path

GET /api/operator/auth/session

Required input: bearer Authorization header. There are no query parameters and no request body. No additional scope is required beyond a valid operator API key or staff session.

Response fields

Top-level:

• auth_type: api_key or staff
• scopes

Operator:

• id
• slug
• name
• status
• currency_code
• balance_adapter_type
• timezone
• default_locale

API key, when auth_type = api_key:

• id
• name
• key_id
• key_prefix
• scopes
• last4
• revoked_at

Staff, when auth_type = staff:

• admin_user_id
• email
• display_name
• role
• status
• must_change_password
• scopes

Use cases

• verify operator config bound to current key
• debug wrong scope issues
• confirm simulator vs rest_v1 adapter mode
• confirm whether a dashboard request is using API-key auth or staff-session auth