Resolve the current principal from the verified JWT

Returns the caller’s identity and authorized tenant scope as derived from the verified bearer token’s claims. Purely a read of the validated token + the merchant/store mapping; it does not establish or mutate a session. A request with a missing/invalid/expired token gets 401.

GET/auth/me

Authorization

AuthorizationBearer token (JWT) · headerrequired

JWT issued by the external IdP via the OAuth 2.0 authorization-code flow (Kinde in production; a simulator in test). The client obtains it and sends it as a Bearer token on every authenticated call. Sarvex's services verify it — issuer, audience, signature (IdP JWKS), expiry — and read identity and tenant from its claims. Sarvex does not issue or revoke these tokens. merchant_id/store_id are read from the verified claims (and the merchant→store mapping), never from the URL. The operator scope is required for /operator/*. Operators acting on a specific merchant pass the X-Operate-As header, which is recorded in the audit log.

Responses

200

Current principal and authorized scope.

user_idstring

Subject claim from the IdP token.

emailstring<email>

rolestring

Allowed:ownerstaffoperator

merchant_idstring

The merchant tenant the caller is authorized for (from claims; for operators, the X-Operate-As context).

store_idsstring[]

Stores under that merchant the caller may act on (merchant → store). One in V1.

401

Missing or invalid credentials.

errorobjectrequired

Show properties

codestringrequired

messagestringrequired

detailsobject | null

Try it

Server

Base URLCustom base URLOverrides the selected server when set.

Authorization

Bearer token (JWT)Remember on this deviceInclude my values in samples

Request

curl -X GET "https://api.sarvex.example.com/v1/auth/me" \
  -H "Authorization: Bearer YOUR_TOKEN"

const response = await fetch("https://api.sarvex.example.com/v1/auth/me", {
  method: "GET",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN"
  }
});

import requests

response = requests.get(
    "https://api.sarvex.example.com/v1/auth/me",
    headers={
        "Authorization": "Bearer YOUR_TOKEN"
    },
)

Response

{
  "user_id": "string",
  "email": "user@example.com",
  "role": "owner",
  "merchant_id": "string",
  "store_ids": [
    "string"
  ]
}

{
  "error": {
    "code": "string",
    "message": "string",
    "details": {}
  }
}