---
title: "Identity and gating status for the current session"
method: GET
path: "/auth/session"
tags: ["auth"]
---

# Identity and gating status for the current session

`GET /auth/session`

Answers for gated users: a waitlisted account gets `200` with `status: "beta_required"`, never a `403`. `401` means there is no valid session at all.

`wallet` is the authoritative binding for the session — one browser holds one session cookie, so a wallet switch in another tab rebinds it. Clients should revalidate this endpoint on `focus`/`visibilitychange` and discard cached per-wallet data when `wallet` changes.

Cookie sessions additionally receive their CSRF token in the `X-CSRF-Token` response header — echo it back on every POST/PUT/PATCH/DELETE. The token is derived from the session cookie, so call this endpoint again to recover from a rotated one.

## Response `200`

Current session

- SessionDto
  - `id` number, required — DRE user id
  - `wallet` string, required — Wallet address this session is bound to
  - `roles` number[], required — Role ids held by the user
  - `status` 'active' | 'profile_required' | 'beta_required', required — Which gate the user is behind. `profile_required` takes precedence over `beta_required`.

## Other responses

- `401` — No valid session
- `403` — Sanctioned region — body `{ statusCode: 403, code: "REGION_BLOCKED", country }`. Never returned for a gated user.

---

[API](https://skmtc.dev/dre/apis/dre-api.md) · [All operations](https://skmtc.dev/dre/apis/dre-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/dre/dre-api/revisions/5d14beb9482b/schema)