Skip to content
ssoossh

The caller's own identity

GET
/api/users/me
curl --request GET \
  --url https://example.com/api/users/me \
  --header 'X-Ssoossh-Key-Secret: <X-Ssoossh-Key-Secret>'

Sourced primarily from the session, with extra fields hydrated from the users table.

Authorizations

Section titled “Authorizations”

Responses

Section titled “Responses”

200

Section titled “200”

The session identity

Media typeapplication/json
object
data
required
object
approvable_service_accounts
required

ApprovableServiceAccounts is what the approval page’s picker is populated from: ServiceAccounts, plus the caller’s own accounts when cert_options.service.allow_user_accounts is on. Sent as its own list rather than computed in the browser so the picker cannot offer an account the server would then refuse.

Array<string>
detail_level
required

DetailLevel is how much of the covered pages this person sees: “simplified” or “advanced”. Stored on the server so it follows the person between browsers; the email level is separate and travels with the notification preferences.

string
Allowed values: simplified advanced simplified advanced simplified advanced simplified advanced simplified advanced simplified advanced
email
required
string
extra
required

Extra holds operator-configured extra fields captured at login from OIDC claims (see config.OAuthFields.Extra). Each value is either a string or an array of strings, reflecting the claim shape at login. Missing or null values in this field are rendered as “MISSING” by key ID templates, so this presence is important for debugging when debugging a key ID template that expected a claim that did not arrive. The frontend should display missing values visibly rather than hiding them.

object
key
additional properties
groups
required
Array<string>
is_admin
required

IsAdmin, IsSOC and IsAuditor report the access levels this session holds, so the UI can show the affordances each one unlocks. The roles nest — an admin holds all three, a SOC member holds SOC and auditor — so more than one is true at a time and the account page names every one rather than only the narrowest. Display only: the server re-checks the matching Grants* rule on every scoped request, so hiding or showing an affordance changes nothing about what this session can do.

boolean
is_auditor
required
boolean
is_nss_key_admin
required

IsNSSKeyAdmin reports the fleet key admin role (admin.nss_key_group, which admin implies): create keys and manage every one. Members of a single key’s group manage that key without it. Display only, like the three above.

boolean
is_soc
required
boolean
name
required

Name is the caller’s human-readable name, for greeting them as a person rather than as an account. Display only, and empty when neither the identity provider nor the directory supplied one.

string
nss_enabled
required

NSSEnabled reports nss.enabled, so the UI shows the fleet keys only where the server serves them.

boolean
other_accounts
required

OtherAccounts are alternate account identifiers this identity is known by on target systems (see config.OAuthFields.OtherAccounts), shown so a user can see every account name tied to their identity. These are also the candidates, alongside Username, that the approval page offers as principals for a user certificate (see ApproveRequestBody.Principals).

Array<string>
service_accounts
required

ServiceAccounts are the service accounts this identity holds (see config.OAuthFields.ServiceAccounts). It is also what the service codes page lists, so it stays the claim alone rather than the wider approval set below.

Array<string>
subject
required
string
user_own_service_accounts
required

UserOwnServiceAccounts is the subset of ApprovableServiceAccounts that is the caller’s own account rather than a claimed service account, so the picker can say what those entries mean before one is chosen: the certificate is still non-interactive, for an unattended job, and is not a way to log in as yourself. Empty when cert_options.service.allow_user_accounts is off.

Array<string>
username
required
string
error
string

Example 

{
  "data": {
    "detail_level": "simplified"
  }
}

401

Section titled “401”

No valid session

Media typeapplication/json
object
data

Data is always null on an error response.

error
required

Error is a human-readable message. Branch on the HTTP status rather than this string; it is for humans and logs.

string
error_code
required

ErrorCode is a machine-readable error classifier. One of the error_code constants from internal/apitypes; use this to decide whether to retry or branch on the failure mode.

string

Example 

{
  "error": "certificate request \"9f1c…\" not found",
  "error_code": "not_found"
}