Skip to content
Kisum • Documentation

Current user from access token

GET
/auth/me

Returns JWT claim fields plus authoritative companyMemberships and businessUnitMemberships from Auth Postgres (same shapes as GET /internal/users/{id}/context).

Authorizations

Section titled “Authorizations ”

Responses

Section titled “ Responses ”

200

Section titled “200 ”

User claims snapshot and membership rows

object
success
required
boolean
data
required
data
object
sub

User id

string
id
string
email
string
name
string
sessionId
string
authType
string
globalRole
string
roles
string
isVendor
boolean
vendorId
string
nullable
tokenVersion
integer
companyMemberships
Array<object>
object
id
string format: uuid
userId
string format: uuid
companyId
string format: uuid
role

Tenant IAM role (e.g. MANAGER company-wide; FINANCE; SUBMITTER). Distinct from BU role on businessUnitMemberships.

string
Allowed values: TENANT_SUPERADMIN ADMIN FINANCE MANAGER SUBMITTER
isActive
boolean
approvalLimit

Optional per-user-per-company approval limit (decimal string; migrated from Finance)

string
nullable
invoiceViewScope

Echoed from metadata.invoiceViewScope when set (OWN | BU | COMPANY). Company-level when user has no BU rows or as default; see README_AUTH_API.md §5.2a.

string
nullable
canEditOthersScope

Echoed from metadata.canEditOthersScope when set.

string
nullable
canEditOthersInvoices

Echoed from metadata.canEditOthersInvoices when set (legacy boolean).

boolean
nullable
metadata

Optional JSON object. Recommended keys for Finance invoice/bill visibility and editing others’ drafts — see README_AUTH_API.md (invoice scope metadata). Omitted on upsert leaves existing metadata unchanged. invoiceViewScope / canEditOthersScope / canEditOthersInvoices are also returned as top-level fields when present.

nullable
createdAt
string format: date-time
updatedAt
string format: date-time
businessUnitMemberships
Array<object>
object
id
string format: uuid
userId
string format: uuid
companyId
string format: uuid
businessUnitId
string format: uuid
role

BU IAM — APPROVER (manager), SUBMITTER, or BU ADMIN; combine with invoiceViewScope for bills.

string
Allowed values: SUBMITTER APPROVER ADMIN
isActive
boolean
invoiceViewScope

Echoed from metadata when set (per-BU invoice list scope).

string
nullable
canEditOthersScope
string
nullable
canEditOthersInvoices
boolean
nullable
metadata

Optional JSON object. For SUBMITTER (and product-defined cases), use invoice scope keys per README_AUTH_API.md. Finance migration may set invoiceViewScope and canEditOthersInvoices (boolean). Scope keys are also echoed as top-level fields when present.

nullable
createdAt
string format: date-time
updatedAt
string format: date-time

401

Section titled “401 ”

Missing/invalid token or credentials

object
success
required
boolean
error
required
object
code
required
string
Example
validation_error
message
required
string