Get Me

Get the authenticated caller (jwt or API key). Convenience for the frontend session.

Declared before /{user_id} so the literal path wins over the param route.

The answer is narrowed for a confined request — read support_session first.

• A company-scoped API key sees companies/memberships narrowed to its bound company (ZET-171): a confined credential is not told about the owner's other tenants — the same rule /users/me/whoami follows. support_session is null.
• Inside a support session (an operator visiting one customer's tenant via the X-Support-Session header) companies and memberships come back empty and is_admin comes back False even for a real administrator — every instance-wide admin surface is refused for the duration of the visit, so claiming the bit would render chrome whose every item 403s. Do not read those three fields as facts about the account here. support_session names the visited company_id and whether the visit currently permits writes (may_write); it is the only thing that tells "I am confined to one tenant" apart from "I belong to nothing", which is otherwise the identical response. /users/me/whoami names the visited company too, and adds the capability manifest.