---
title: "Get authenticated shell bootstrap data"
method: GET
path: "/auth/bootstrap"
---

# Get authenticated shell bootstrap data

`GET /auth/bootstrap`

## Request

- Base URL: `https://api.eurobase.dev`
- URL: `https://api.eurobase.dev/auth/bootstrap`
- Auth: none declared

Returns cached workspace and notification data plus the current tenant-scoped GitHub account and installation summary from DB. It reissues the same session and already-present CSRF cookies only when this response renewed the session. The GitHub summary is read-only, uses no provider request, and does not repair or rewrite the user shell row. Read failures are request failures only; they are not logout semantics and do not clear browser auth cookies. The console's first hydration may also embed the first project list page and one project Dashboard, read concurrently with the bootstrap; each embedded part carries the status and body its own route (GET /projects, GET /projects/{id}/dashboard) would return, and its failure never fails the bootstrap.

## Query parameters

- `includeProjectList` '1'
- `includeProjectDashboard` '1'
- `projectId` string
- `timeRange` '30m' | '6h' | '24h' | '7d'

## Response `200`

Shell bootstrap

- AuthBootstrapResponse
  - `user` AuthUser, required
    - `id` string, required
    - `email` string, required
    - `status` string, nullable
    - `deleteRequestedAt` string, date-time, nullable
    - `deletionState` 'billing_pending' | 'cleanup_pending' | 'null', nullable
    - `emailVerifiedAt` string, date-time, nullable
    - `emailVerified` boolean, required
    - `authAccessState` 'verified' | 'email_verification_required', required
    - `avatarUrl` string, nullable, required: Profile picture of the most recently used linked Google or GitHub sign-in that has one.
    - `createdAt` string, date-time, required
  - `authAccessState` 'verified' | 'email_verification_required', required
  - `emailVerification` object, required
    - `required` boolean, required
    - `verified` boolean, required
    - `sent` boolean, required
  - `capabilities` SessionCapabilities, required
    - `operator` boolean, required
    - `ownerOperator` boolean, required
  - `clientIp` string, nullable, required
  - `workspace` SessionWorkspace, required
    - `currentOrganizationId` string, nullable, required
    - `accessibleProjectCount` integer, required
    - `defaultProject` SessionProjectSummary, required
      - `id` string, required
      - `name` string, required
      - `projectRole` string, nullable, required
      - `branch` string, required
    - `organizations` OrganizationSummary[], required
      - `id` string, required
      - `name` string, required
      - `projectCount` integer, required
      - `membership` OrganizationMembership, nullable, required
        - `id` string, required
        - `organizationId` string, required
        - `userId` string, required
        - `status` 'active' | 'invited' | 'suspended', required
        - `createdAt` string, date-time, required
        - `updatedAt` string, date-time, required
      - `createdByUserId` string, required
      - `canRename` boolean: Whether the caller is the billing owner and may rename it. Present on organization reads, not on the session workspace.
      - `createdAt` string, date-time, required
      - `updatedAt` string, date-time, required
  - `githubAccount` GitHubAccount, nullable, required
    - `login` string, required
    - `name` string, nullable
    - `avatarUrl` string, nullable
    - `oauthStatus` 'connected' | 'revoked' | 'unknown' | 'null', nullable
    - `oauthStatusReason` string, nullable
    - `oauthVerifiedAt` string, date-time, nullable
    - `snapshotVersion` integer
    - `createdAt` string, date-time, nullable
    - `updatedAt` string, date-time, nullable
  - `githubState` GitHubStateSummary, required
    - `accountStatus` 'none' | 'unknown' | 'connected' | 'revoked', required
    - `accountStatusReason` string, nullable
    - `accountVerifiedAt` string, date-time, nullable
    - `installationCount` integer, required
    - `repoCount` integer, required: Sum of non-negative cached installation repository counts before repository filtering or response bounds. Any missing stored installation count keeps the snapshot not ready with refresh recovery.
    - `sync` GitHubSyncState, required
      - `status` 'ok' | 'partial' | 'stale', required
      - `message` string, nullable
      - `errors` GitHubSyncError[], required
        - `code` string, required
        - `scope` 'installations' | 'repositories', required
        - `actor` 'user' | 'operator' | 'unknown', required
        - `recoveryAction` 'reconnect-oauth' | 'install-app' | 'open-installation-access' | 'retry-refresh' | 'operator-fix', required
        - `message` string, required
      - `primaryError` GitHubSyncError
        - `code` string, required
        - `scope` 'installations' | 'repositories', required
        - `actor` 'user' | 'operator' | 'unknown', required
        - `recoveryAction` 'reconnect-oauth' | 'install-app' | 'open-installation-access' | 'retry-refresh' | 'operator-fix', required
        - `message` string, required
    - `snapshotVersion` integer, required
    - `snapshotUpdatedAt` string, date-time, nullable
    - `hasSavedAccess` boolean, required
    - `projectCreateAvailable` boolean, required
    - `recommendedAction` 'none' | 'oauth' | 'refresh' | 'install' | 'manage' | 'review' | 'disabled', required
    - `recoveryAction` GitHubConnectAction, required
      - `kind` 'none' | 'oauth' | 'refresh' | 'install' | 'manage' | 'review' | 'disabled', required
      - `label` string, required
      - `href` string, nullable
      - `disabled` boolean
      - `reason` string, nullable
    - `repositoryAccessAction` GitHubConnectAction
      - `kind` 'none' | 'oauth' | 'refresh' | 'install' | 'manage' | 'review' | 'disabled', required
      - `label` string, required
      - `href` string, nullable
      - `disabled` boolean
      - `reason` string, nullable
    - `navStatus` object, required
      - `tone` 'neutral' | 'healthy' | 'warning' | 'danger', required
      - `label` string, required
    - `ready` boolean, required
  - `notificationSummary` NotificationSummary, required
    - `organizationId` string, nullable
    - `unreadCount` integer, required
    - `criticalUnreadCount` integer, required
    - `latestUnreadAt` string, date-time, nullable
    - `updatedAt` string, date-time, nullable, required
    - `cursor` string, nullable, required
  - `bootstrapVersion` integer, required
  - `projectList` object: Present only with includeProjectList=1. body is ProjectsResponse when statusCode is 200, else the error GET /projects would return, with this response's requestId; headers then carries its retry-after. The part runs after the bootstrap read within one 2 s budget, past which it is a 503 db-read-timeout.
    - `statusCode` integer, required
    - `headers` object
    - `body` union, required
      - ProjectsResponse
        - `projects` ProjectCard[], required
          - `id` string, required
          - `name` string, nullable, required
          - `organizationId` string, nullable, required
          - `workspace` object, required: The workspace that owns the project and the email of the person who pays for it; shared is true when it is not the caller's own (ADR 0098).
            - `name` string, required
            - `shared` boolean, required
            - `ownerEmail` string, nullable, required
          - `projectMembershipId` string, nullable, required
          - `projectRole` 'owner' | 'admin' | 'contributor' | 'null', nullable, required
          - `region` string, nullable, required
          - `deploymentMode` 'runtime' | 'static', required
          - `repoFullName` string, nullable, required
          - `branch` string, required
          - `rootDir` string, required
          - `runCommand` string, nullable, required
          - `healthPath` string, required
          - `containerPort` integer, required
          - `projectSlug` string, nullable, required
          - `projectHostname` string, nullable, required
          - `primaryHostname` string, nullable, required: Official address of the project: its active custom domain whose DNS points at Eurobase, the one that went live first when several do, otherwise projectHostname. projectHostname stays reserved and keeps serving.
          - `lifecycleState` string, nullable, required
          - `activeDeploymentId` string, nullable, required
          - `projectRoute` ProjectRoute, required
            - `status` 'healthy' | 'repairing' | 'degraded' | 'broken' | 'unknown', required
            - `reasonCode` 'none' | 'dns_record_missing' | 'dns_propagating' | 'domain_binding_missing' | 'tls_pending' | 'missing_project_upstream' | 'upstream_unreachable' | 'ingress_unreachable' | 'unmanaged_custom_domain' | 'scw_mutation_failed', required
            - `checkedAt` string, date-time, nullable
            - `lastRepairAt` string, date-time, nullable
            - `lastError` string, nullable
            - `managed` boolean, required
            - `convergenceState` 'recovering' | 'exhausted' | 'ready' | 'null', nullable
            - `upstream` ProjectUpstreamState, required
              - …
          - `releaseUsability` ReleaseUsability, required
            - `status` 'reachable' | 'degraded' | 'blocked' | 'unknown', required
            - `reasonCode` 'none' | 'missing_live_release' | 'access_not_allowed' | 'route_repair_in_progress' | 'route_incident' | 'project_suspended', required
            - `lastLiveDeploymentId` string, nullable, required
          - `projectSummaryStatus` ProjectSummaryStatus, required
            - `label` string, required
            - `tone` 'neutral' | 'problem' | 'error', required
            - `code` 'setup_required' | 'route_issue' | 'deploy_failed' | 'deploy_unhealthy' | 'live_release_blocked' | 'status_check_delayed' | 'deploy_in_progress' | 'rollback_live' | 'healthy' | 'suspended', required
            - `detailTitle` string, nullable, required
            - `detail` string, nullable, required
          - `servingSuspension` ProjectServingSuspension: An operator suspension of the project's public serving (ADR 0080). Operator notes and evidence are never included.
            - `state` 'suspended', required
            - `reasonCategory` 'phishing' | 'malware' | 'shared_domain_abuse' | 'spam' | 'illegal_content' | 'legal_order' | 'other_policy_violation', required
            - `reasonLabel` string, required
            - `since` string, date-time, nullable, required
            - `supportEmail` string, required
            - `policyUrl` string, required
          - `sourceProfile` ProjectSourceProfileSummary, required
            - `framework` 'next' | 'astro' | 'svelte-kit' | 'nuxt' | 'react-router' | 'vite' | 'hono' | 'nestjs' | 'fastify' | 'express' | 'django' | 'fastapi' | 'flask' | 'laravel' | 'rails' | 'node' | 'python' | 'php' | 'ruby' | 'go' | 'java' | 'dotnet' | 'static', required
            - `frameworkLabel` string, required
            - `outputMode` 'runtime' | 'static', required
          - `createdAt` string, date-time, nullable, required
          - `updatedAt` string, date-time, nullable, required
          - `activeDeployment` ProjectCardDeployment, required
            - `id` string, required
            - `status` string, nullable, required
            - `displayStatus` 'queued' | 'waiting_for_builder' | 'building_image' | 'waiting_for_deploy_runner' | 'deploying' | 'healthy' | 'unhealthy' | 'failed' | 'rolled_back' | 'status_check_delayed', required
            - `buildQueuePosition` integer, nullable: Place in the source build admission queue while the build waits for capacity.
            - `healthy` boolean, required
            - `commitSha` string, nullable, required
            - `createdAt` string, date-time, nullable, required
            - `updatedAt` string, date-time, nullable, required
          - `latestDeployment` ProjectCardDeployment, required
            - `id` string, required
            - `status` string, nullable, required
            - `displayStatus` 'queued' | 'waiting_for_builder' | 'building_image' | 'waiting_for_deploy_runner' | 'deploying' | 'healthy' | 'unhealthy' | 'failed' | 'rolled_back' | 'status_check_delayed', required
            - `buildQueuePosition` integer, nullable: Place in the source build admission queue while the build waits for capacity.
            - `healthy` boolean, required
            - `commitSha` string, nullable, required
            - `createdAt` string, date-time, nullable, required
            - `updatedAt` string, date-time, nullable, required
          - `latestDeployAt` string, date-time, nullable, required: Most recent deploy across the app, Containers, and Functions; null when nothing was deployed.
        - `nextCursor` string, nullable, required
        - `usageSummary` ProjectsUsageSummary, required
          - `period` object, required
            - `startAt` string, date-time, required
            - `endAt` string, date-time, required
          - `rows` ProjectsUsageSummaryRow[], required
            - `metric` 'runtime_requests' | 'runtime_response_bytes' | 'runtime_latency_ms_sum' | 'runtime_active_seconds' | 'runtime_cpu_seconds' | 'runtime_memory_gb_seconds' | 'function_requests' | 'function_execution_gb_seconds' | 'storage_stored_bytes' | 'storage_egress_bytes' | 'storage_operations' | 'build_seconds' | 'stored_artifact_bytes' | 'storage_bandwidth_bytes' | 'centralized_log_bytes', required
            - `label` string, required
            - `value` string, required
            - `valueDisplay` string, required
            - `progress` number, required
          - `updatedAt` string, date-time, required
      - object
  - `projectDashboard` object, nullable: Present only with includeProjectDashboard=1; null when the workspace has no project. body is ProjectDashboardResponse when statusCode is 200, else the error GET /projects/{id}/dashboard would return for projectId, as for projectList.
    - `projectId` string, required
    - `statusCode` integer, required
    - `headers` object
    - `body` union, required
      - ProjectDashboardResponse
        - `resourceMap` ProjectResourceMapResponse, required
          - `project` ProjectSummary, required
            - `id` string, required
            - `name` string, nullable
            - `organizationId` string, nullable
            - `projectMembershipId` string, nullable
            - `projectRole` 'owner' | 'admin' | 'contributor' | 'null', nullable
            - `projectSlug` string, nullable
            - `projectHostname` string, nullable
            - `primaryHostname` string, nullable: Official address of the project: its active custom domain whose DNS points at Eurobase, the one that went live first when several do, otherwise projectHostname. projectHostname stays reserved and keeps serving.
            - `deploymentMode` 'runtime' | 'static', required
            - `lifecycleState` string, nullable
            - `deleteRequestedAt` string, date-time, nullable
            - `projectRoute` ProjectRoute, required
              - …
            - `releaseUsability` ReleaseUsability, required
              - …
            - `projectSummaryStatus` ProjectSummaryStatus
              - …
            - `servingSuspension` ProjectServingSuspension: An operator suspension of the project's public serving (ADR 0080). Operator notes and evidence are never included.
              - …
            - `sourceProfile` ProjectSourceProfileSummary, required
              - …
            - `sourceLock` ProjectSourceLock: ADR 0090: while locked, no caller can change the project repository, branch, root directory or deployment mode.
              - …
          - `region` ProjectResourceMapRegion, required
            - `code` string, required
            - `label` string, required
          - `nodes` ProjectResourceMapNode[], required
            - `id` string, required
            - `kind` 'region' | 'git_source' | 'app_deployment' | 'container' | 'function' | 'storage_bucket', required
            - `resourceId` string, nullable, required
            - `label` string, required
            - `subtitle` string, nullable, required
            - `status` ProjectResourceMapNodeStatus, required
              - …
            - `access` ProjectResourceMapNodeAccess, required
              - …
            - `href` string, nullable, required
            - `sourceProfile` ProjectSourceProfileSummary, required
              - …
            - `meta` ProjectResourceMapNodeMeta[], required
              - …
          - `links` ProjectResourceMapLink[], required
            - `fromNodeId` string, required
            - `toNodeId` string, required
            - `kind` 'project_context' | 'source_dependency', required
          - `generatedAt` string, date-time, required
        - `telemetryOverview` ProjectTelemetryOverviewResponse, required
          - `project` ProjectSummary, required
            - `id` string, required
            - `name` string, nullable
            - `organizationId` string, nullable
            - `projectMembershipId` string, nullable
            - `projectRole` 'owner' | 'admin' | 'contributor' | 'null', nullable
            - `projectSlug` string, nullable
            - `projectHostname` string, nullable
            - `primaryHostname` string, nullable: Official address of the project: its active custom domain whose DNS points at Eurobase, the one that went live first when several do, otherwise projectHostname. projectHostname stays reserved and keeps serving.
            - `deploymentMode` 'runtime' | 'static', required
            - `lifecycleState` string, nullable
            - `deleteRequestedAt` string, date-time, nullable
            - `projectRoute` ProjectRoute, required
              - …
            - `releaseUsability` ReleaseUsability, required
              - …
            - `projectSummaryStatus` ProjectSummaryStatus
              - …
            - `servingSuspension` ProjectServingSuspension: An operator suspension of the project's public serving (ADR 0080). Operator notes and evidence are never included.
              - …
            - `sourceProfile` ProjectSourceProfileSummary, required
              - …
            - `sourceLock` ProjectSourceLock: ADR 0090: while locked, no caller can change the project repository, branch, root directory or deployment mode.
              - …
          - `timeRange` '30m' | '6h' | '24h' | '7d', required
          - `windowGranularity` '5m' | '1h' | '1d', required
          - `windowStart` string, date-time, required
          - `windowEnd` string, date-time, required
          - `bucketStarts` string[], required
          - `availability` 'ready' | 'partial' | 'unavailable' | 'cutover_incomplete', required
          - `totals` object, required
            - `totalActivity` integer, nullable, required
            - `totalRequests` integer, required
            - `successRate` number, nullable, required: Percentage of requests with a recorded status that did not return 5xx; null when none has a status.
          - `series` object, required
            - `totalActivity` integer[], required
            - `totalRequests` integer[], required
          - `families` object, required
            - `deploymentTraffic` ProjectTelemetryFamilySummary, required
              - …
            - `containerTraffic` ProjectTelemetryFamilySummary, required
              - …
            - `functionHostTraffic` ProjectTelemetryFamilySummary, required
              - …
            - `storageActivity` ProjectTelemetryFamilySummary, required
              - …
          - `breakdowns` object, required
            - `deploymentTraffic` object, required
              - …
            - `containerTraffic` object, required
              - …
            - `functionHostTraffic` object, required
              - …
            - `storageActivity` object, required
              - …
          - `updatedAt` string, date-time, required
      - object

## Other responses

- `403`: Admission denied. Email-verification-required includes the same auth-only identity as SessionResponse and no workspace, GitHub, or notification data; beta admission retains its typed denial.

---

[API](https://skmtc.dev/eurobase/apis/eurobase-api.md) · [All operations](https://skmtc.dev/eurobase/apis/eurobase-api/llms.txt) · [OpenAPI document](https://skmtc.dev/eurobase/apis/eurobase-api/revisions/5266a299d18a?raw)