---
title: "Get Me"
method: GET
path: "/users/me"
tags: ["users"]
---

# Get Me

`GET /users/me`

## Request

- Base URL: `https://app.zeno-works.ch` (the document declares no server; this is the origin it was published from)
- URL: `https://app.zeno-works.ch/users/me`
- Auth: none declared

Get the authenticated caller (jwt or API key). Convenience for the frontend session.

Declared before ``/{user_id}`` so the literal path wins over the param route.

**The answer is narrowed for a confined request — read ``support_session`` first.**

- A **company-scoped API key** sees ``companies``/``memberships`` narrowed to its
  bound company (ZET-171): a confined credential is not told about the owner's other
  tenants — the same rule ``/users/me/whoami`` follows. ``support_session`` is null.
- Inside a **support session** (an operator visiting one customer's tenant via the
  ``X-Support-Session`` header) ``companies`` and ``memberships`` come back **empty**
  and ``is_admin`` comes back **False even for a real administrator** — every
  instance-wide admin surface is refused for the duration of the visit, so claiming
  the bit would render chrome whose every item 403s. Do **not** read those three
  fields as facts about the account here. ``support_session`` names the visited
  ``company_id`` and whether the visit currently permits writes (``may_write``); it
  is the only thing that tells "I am confined to one tenant" apart from "I belong to
  nothing", which is otherwise the identical response. ``/users/me/whoami`` names
  the visited company too, and adds the capability manifest.

## Headers

- `authorization` string, nullable

## Cookies

- `access_token` string, nullable

## Response `200`

Successful Response

- MeResponse: ``GET``/``PATCH /users/me`` → the caller, **and why the answer is narrowed**. A superset of :class:`UserResponse` (``user`` is byte-identical), so an existing client is unaffected. The extra field exists because ``user`` alone cannot be read correctly inside a support session — see :class:`SupportSessionContext`. ``support_session`` is **required-but-nullable**, never optional: the same rule :attr:`Capability.operation` states. A client must be able to tell "not in a session" (``null``) from "this server predates the field" (absent), and an absent field in the generated client types is an ``undefined`` no consumer guards.
  - `user` UserOut, required: Serialized user (no secrets). ``companies`` is an array of company ids; ``memberships`` adds the per-membership role.
    - `id` string, required
    - `first_name` string, required
    - `last_name` string, required
    - `email` string, email, required
    - `phone` string, nullable
    - `is_admin` boolean, required
    - `is_active` boolean, required
    - `ui_language` string, nullable
    - `companies` string[]
    - `memberships` MembershipOut[]
      - `company_id` string, required
      - `role` 'owner' | 'accountant' | 'member', required
  - `support_session` SupportSessionContext, required: Why a ``/users/me`` answer is narrowed: the request is inside a support session. Present **only** on the ``/users/me`` envelope, because ``/users/me`` is the one endpoint whose narrowing is otherwise indistinguishable from a fact about the account. Inside a session the caller's ``companies`` and ``memberships`` come back empty and ``is_admin`` comes back ``False`` — which is byte-identical to the answer a brand-new user with no memberships gets. Those two states demand opposite behaviour from a client (the new user must be offered onboarding; the confined operator must not be offered a cross-tenant create), so a client that cannot tell them apart will get one of them wrong. This field is how it tells them apart. It discloses nothing: the caller named this session themselves, in the ``X-Support-Session`` header of the request being answered.
    - `company_id` string, required
    - `may_write` boolean, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/zeno-works/apis/zeno-api.md) · [All operations](https://skmtc.dev/zeno-works/apis/zeno-api/llms.txt) · [OpenAPI document](https://skmtc.dev/zeno-works/apis/zeno-api/revisions/1eb93dde146c?raw)