---
title: "Get the current user"
method: GET
path: "/customers/user"
tags: ["Users"]
---

# Get the current user

`GET /customers/user`

Returns the authenticated `User` derived from the bearer token on
the request — i.e. a "whoami" probe for confirming credentials
are valid and inspecting the caller's identity, organisation and
site access.

Although the endpoint is mounted under the `api-public`
middleware (no auth required for the route to resolve), the
response body is meaningful only when a bearer token is
supplied — without one, the body is `null`. Use this in clients
that need to test "is my token still good?" without committing
to a heavier authenticated request.

## Response `200`

The current user, or `null` if the request is unauthenticated.

- User
  - `id` string, uuid, required — Stable unique identifier for the user. Treat as opaque even though the underlying format is a UUID — never parse or construct it client-side.
  - `name` string, required — The user's display name, typically `given_name family_name` but may diverge for users who supplied an alternative.
  - `given_name` string, required — The user's first / given name, as supplied at registration or sync from the identity provider.
  - `family_name` string, required — The user's surname / family name, as supplied at registration or sync from the identity provider.
  - `email` string, email, required — The user's primary email address. Used for sign-in, notification delivery, and forms-of-identity verification.
  - `email_verified` boolean, required — Whether the user has verified their email address
  - `organisation_id` string, uuid, required — ID of the organisation this user is scoped to. Every user belongs to exactly one organisation; cross-org access is modelled via separate user accounts.
  - `organisation_name` string, nullable, required — Human-readable name of the user's organisation, denormalised onto the User payload so callers don't need to make a second fetch. `null` when the organisation has been archived.
  - `site_ids` string[], required — The IDs of the sites that this user belongs to
  - `avatar_id` string, uuid, nullable, required — ID of the `Media` record holding the user's avatar image. Use `avatar.urls` on this same payload to render directly without a separate Media fetch. `null` when the user hasn't uploaded one.
  - `avatar` Media
    - `id` string, uuid, required — Unique identifier of the uploaded media item, returned from `createMedia`. Pass this ID into any field that accepts a media reference (logos, hero images, product images, etc.).
    - `file_name` string, required — Original filename of the uploaded asset, preserved as provided at upload time. Used for display in the media library and as a hint when serving downloads.
    - `mime_type` string, required — The mime type of the media item.
    - `original_url` string, required — The url of the media resource.
    - `size` integer, required — The size of the media item in bytes.
    - `url` string, required — The url of the converted media resource.
  - `cashier_id` string, nullable — Optional cashier identifier linking this user to a Point of Sale cashier profile. `null` when the user isn't a POS operator.
  - `status` string, required — Lifecycle status of the user account. `active` for normal sign-in, `disabled` for accounts locked by an admin.
  - `2fa_enabled` boolean — Whether 2FA is enabled for the user
  - `twofa_enabled` boolean, required — Whether 2FA is enabled for the user
  - `created_at` string, date-time, required — The date and time the user was created
  - `updated_at` string, date-time, required — The date and time the user was last updated
  - `managed_by_sso` boolean, required — Whether the user is managed by SSO
  - `whitelisted_internal_user` boolean — Whether the user is a whitelisted internal user

---

[API](https://skmtc.dev/try/apis/trybe-api.md) · [All operations](https://skmtc.dev/try/apis/trybe-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/try/trybe-api/revisions/f37f92702da5/schema)