authStatus

GET

/api/v1/auth/status

const url = 'https://example.com/api/v1/auth/status';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://example.com/api/v1/auth/status

Public. Reports whether one-time setup is still required and, when a valid dashboard session cookie is present, the current user, their role, the CSRF token for unsafe browser requests, the auth method, and whether MFA enrollment is still pending. This is the current-user read for Studio and for future API clients.

Responses

200

Installation state and, when authenticated, the current user

application/json

object

setupRequired

required

boolean

authenticated

required

boolean

passkeysAvailable

required

boolean

passkeysUnavailableReason

string

demoMode

boolean

user

object

required

string format: uuid

name

required

string

username

required

string

role

required

Role key. The built-in roles are owner, administrator, editor, contributor, and viewer. Custom role keys start with “custom.”. Decide authorization from the capabilities the server reports, not from the role key.

string

/^[a-z][a-z0-9.-]{1,63}$/

active

required

boolean

createdAt

required

string format: date-time

lastLoginAt

string format: date-time

capabilities

Effective capabilities of the authenticated user’s live role. Studio uses them to decide which workspaces and actions to offer; every API route still makes its own decision.

Array<string>

csrfToken

string

authMethod

The factor that completed the session sign-in, or pat or oauth when the caller authenticated with a bearer grant.

string

Allowed values: password totp passkey recovery_code demo pat oauth

mfaEnrollmentRequired

boolean

Example

{
  "user": {
    "role": "owner"
  },
  "authMethod": "password"
}