Sign in
Users

Get the current user

Returns the authenticated User derived from the bearer token on the request — i.e. a "whoami" probe for confirming credentials are valid and inspecting the caller's identity, organisation and site access.

Although the endpoint is mounted under the api-public middleware (no auth required for the route to resolve), the response body is meaningful only when a bearer token is supplied — without one, the body is null. Use this in clients that need to test "is my token still good?" without committing to a heavier authenticated request.

get/customers/user

Response

The current user, or null if the request is unauthenticated.

idstring uuid required

Stable unique identifier for the user. Treat as opaque even though the underlying format is a UUID — never parse or construct it client-side.

namestring required

The user's display name, typically given_name family_name but may diverge for users who supplied an alternative.

given_namestring required

The user's first / given name, as supplied at registration or sync from the identity provider.

family_namestring required

The user's surname / family name, as supplied at registration or sync from the identity provider.

emailstring email required

The user's primary email address. Used for sign-in, notification delivery, and forms-of-identity verification.

email_verifiedboolean required

Whether the user has verified their email address

organisation_idstring uuid required

ID of the organisation this user is scoped to. Every user belongs to exactly one organisation; cross-org access is modelled via separate user accounts.

organisation_namestring nullable required

Human-readable name of the user's organisation, denormalised onto the User payload so callers don't need to make a second fetch. null when the organisation has been archived.

site_idsstring[] required

The IDs of the sites that this user belongs to

avatar_idstring uuid nullable required

ID of the Media record holding the user's avatar image. Use avatar.urls on this same payload to render directly without a separate Media fetch. null when the user hasn't uploaded one.

cashier_idstring nullable

Optional cashier identifier linking this user to a Point of Sale cashier profile. null when the user isn't a POS operator.

statusstring required

Lifecycle status of the user account. active for normal sign-in, disabled for accounts locked by an admin.

2fa_enabledboolean

Whether 2FA is enabled for the user

twofa_enabledboolean required

Whether 2FA is enabled for the user

created_atstring date-time required

The date and time the user was created

updated_atstring date-time required

The date and time the user was last updated

managed_by_ssoboolean required

Whether the user is managed by SSO

whitelisted_internal_userboolean

Whether the user is a whitelisted internal user

Example response

{
  "id": "5e1e3f6c-2a44-4f6e-8c61-9c1f7d2e1c11",
  "name": "John Smith",
  "given_name": "John",
  "family_name": "Smith",
  "email": "john.smith@example.com",
  "email_verified": true,
  "organisation_id": "9c3ad1e2-2d1b-4f4f-9e07-6d6c4f3a2b1a",
  "organisation_name": "Trybe Spa Group",
  "avatar_id": "7d2a1f9c-5b3e-4d8c-9f0a-2c4e6f8b1d3a",
  "avatar": {
    "file_name": "super-cool-photo.jpg",
    "mime_type": "image/jpeg",
    "original_url": "https://example.com/media/super-cool-photo.jpg",
    "size": 84256,
    "url": "https://example.com/media/super-cool-photo-thumbnail@2x.jpg"
  },
  "cashier_id": "cashier-042",
  "status": "active",
  "2fa_enabled": true,
  "twofa_enabled": true,
  "created_at": "2020-01-01T00:00:00.000Z",
  "updated_at": "2020-01-01T00:00:00.000Z",
  "managed_by_sso": true
}

Changes