Effective capabilities for the current user

GET

/auth/me/capabilities

• Local development behind nginx (port 8088 by default)

Returns the fully resolved capability set: role-chain capabilities unioned with explicit grants, minus explicit revokes. This is what middleware uses for enforcement.

Authorizations

• cookieAuth
• bearerAuth

Responses

200

Effective capability set

object

user_ref

required

integer format: int64

role

object

id

required

string format: uuid

name

required

string

description

required

string

parent_id

Single-inheritance parent role; null for root roles.

string format: uuid

nullable

capabilities

required

Capability codes attached directly to this role. Does NOT include inherited capabilities — chase parent_id to get the full set, or call /auth/me/capabilities for the resolved view of the current user.

Array<string>

capabilities

required

The resolved capability set: (role chain capabilities) UNION (explicit grants) EXCEPT (explicit revokes). What middleware checks against when enforcing x-required-capabilities.

Array<string>

grants

Capabilities granted explicitly to this user.

Array<string>

revokes

Capabilities revoked explicitly from this user.

Array<string>

401

Authentication required, missing, or invalid

object

error

required

Human-readable error summary

string

Example

the request could not be completed

Example

{
  "error": "authentication required: sign in and retry with a valid session or API token"
}