---
title: "Return everything the auth gate decided about this request."
method: GET
path: "/api/v1/diagnostics/whoami"
tags: ["Diagnostics"]
---

# Return everything the auth gate decided about this request.

`GET /api/v1/diagnostics/whoami`

## Request

- Base URL: `https://api.avatarfactory.io` (the document declares no server; this is the origin it was published from)
- URL: `https://api.avatarfactory.io/api/v1/diagnostics/whoami`
- Auth: one of:
  - API key in cookie `session`
  - HTTP bearer

<br/>Use cases:<br/><br/>- Confirm session-based auth is wired correctly (`session_present`).<br/>- Confirm a Bearer JWT was accepted (`bearer_token_present`).<br/>- Inspect the Cognito groups your token carries (`groups`).<br/>- List every Cognito identity (Google / Facebook / email) linked<br/>  to your local user row (`identities`).<br/>- Sanity-check the pool the backend is pointed at (`cognito_*`).<br/>- See whether the request runs under an admin impersonation grant<br/>  (`impersonating` + `real_admin_email`, spec §3.6); the SPA<br/>  banner renders from this, the server's truth.<br/>- Read whether the caller has a product subscription at all<br/>  (`has_subscription`), which is what tells the partner shell<br/>  whether a Product tab would lead anywhere but the paywall.<br/>- Read whether the caller is in the affiliate program at all<br/>  (`is_affiliate`), which is what lets the plan paywall offer a<br/>  partner a route back to their portal.<br/><br/>Authenticated callers only — anonymous requests get 401.

## Response `200`

OK

- AuthWhoamiResponse: The shape `/api/v1/diagnostics/whoami` returns. Exposes everything the auth gate decided about *this* request so a developer (or future admin debug UI) can diagnose "why am I being asked to log in" / "why does my admin badge not show" without grepping logs. Authenticated callers only: anonymous requests get a 401 from `@login_required`. While an admin impersonation grant is active (`X-Impersonation-Grant`) every identity field describes the TARGET user; `impersonating` + `real_admin_email` carry the server's truth about the view session so the SPA renders the banner from whoami, not client state (spec §3.6).
  - `bearer_token_present` boolean
  - `cognito_client_id` string, nullable
  - `cognito_configured` boolean
  - `cognito_region` string, nullable
  - `cognito_user_pool_id` string, nullable
  - `display_name` string, nullable, required
  - `email` string, nullable, required
  - `groups` string[]
  - `has_subscription` boolean
  - `identities` AuthIdentityRow[]
    - `email_at_provider` string, nullable
    - `linked_at` string, nullable
    - `provider` string, required
    - `provider_sub` string, required
  - `impersonating` ImpersonatedIdentity: Who the caller is currently viewing as (spec §3.6). Mirrors the identity fields the SPA banner renders; the id is already exposed as the response's `user_id` (the swap makes the target the request's current user).
    - `display_name` string, nullable
    - `email` string, nullable
  - `is_admin` boolean, required
  - `is_affiliate` boolean
  - `is_internal` boolean
  - `is_onboarded` boolean
  - `meta_registration_event_id` string, nullable
  - `meta_registration_pending` boolean
  - `niche` string, nullable
  - `real_admin_email` string, nullable
  - `role` string, required
  - `session_present` boolean
  - `user_id` integer, required

## Other responses

- `422`: Unprocessable Entity

---

[API](https://skmtc.dev/avatarfactory/apis/avatarfactory-api.md) · [All operations](https://skmtc.dev/avatarfactory/apis/avatarfactory-api/llms.txt) · [OpenAPI document](https://skmtc.dev/avatarfactory/apis/avatarfactory-api/revisions/66fc7aa3f296?raw)