Get the authenticated user (name, email, photo) and the tenants they have access to. Call this first to discover the user and their tenants; then use queryTenant with a tenant's slug to load that tenant's boards, permissions, and other scoped details. When called through an OAuth application (e.g. the MCP server), the response includes an oAuth object at the root (the acting application, when it was registered, and when the user granted it access) and, on each tenant, an oAuth object with that application's read/write access. These application permissions cap what the user can do here: if a tenant's oAuth.access is "read" (not "full"), writes to that tenant are rejected even if the user themselves has write permission (they would still be able to write via the 21RISK web app). For a regular web-app session the oAuth fields are null.