`get_auth_me`

Read-only

Calls GET /api/auth/me as the signed-in person · REST reference

The calling principal, with freshly re-hydrated permissions

Answers with the SAME shape as the user object on the login response, but built from permissions re-resolved from the graph on this request rather than from anything signed into the token — so a role change takes effect here on the next call instead of only after re-login. The body is bare (no success envelope). capabilities and isPlatformStaff are derived projections for UI gating; enforcement stays on the fine-grained permissions strings, and roles are display and audit only. The middleware also re-checks that the principal still exists in the graph and that its session is live, so a token minted before a user deletion or a logout is refused with 401 even though its signature is still good.

Arguments

This tool takes no arguments.

Example call

A client sends this over the MCP session; Claude and other agents build it for you. The values are placeholders — the shape is real.

json

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "get_auth_me",
    "arguments": {}
  }
}

Result

On success (HTTP 200) the tool returns one text item holding the API's JSON, pretty-printed.

The authenticated principal.

json

{
  "email": "name@example.org",
  "id": "11111111-1111-4111-8111-111111111111",
  "capabilities": [
    "string"
  ],
  "firstName": "string",
  "isPlatformStaff": true,
  "lastName": "string",
  "organizations": [
    {
      "commands": [],
      "orgId": "11111111-1111-4111-8111-111111111111",
      "orgName": "string",
      "orgType": "string",
      "queries": [],
      "roles": []
    }
  ],
  "permissions": [
    "string"
  ],
  "roles": [
    "string"
  ],
  "status": "string"
}

Fields

Field	Type	Description
`capabilities`	array of string	Coarse "<domain>:manage" / "<domain>:view" bundles derived from permissions for UI gating (src/utils/capabilities.ts). Not an authorization surface.
`email`	string (email)
`firstName`	string
`id`	string (uuid)
`isPlatformStaff`	boolean	Mirrors the requirePlatformStaff route gate, derived from permissions.
`lastName`	string
`organizations`	array of object	Every org the user belongs to, with that org permission grants.
`organizations[].commands`	array of string
`organizations[].orgId`	string (uuid)
`organizations[].orgName`	string
`organizations[].orgType`	string \| null	The org type in the enum spelling (e.g. SERVICE_PROVIDER, DISTRIBUTOR), or null when it has no recognised type. For UI gating — a service provider is shown voucher intake and payouts, never donation panels. The rules it informs are enforced server-side.
`organizations[].queries`	array of string
`organizations[].roles`	array of string
`permissions`	array of string	Flattened, de-duplicated execute:<Command> / query:<Query> strings.
`roles`	array of string	Role NAMES, aggregated across the user org memberships. Display and audit only — roles are graph-driven and open-ended, so never gate on a value here.
`status`	string

When it fails

A failed call returns isError: true with the API's message as text.

403: The bearer is a donor token — a credential for the other realm.

What the model is shown

This is the tool exactly as the server lists it in tools/list. The description starts with the REST call it makes.

json

{
  "name": "get_auth_me",
  "description": "GET /api/auth/me — Answers with the SAME shape as the `user` object on the login response, but built from permissions re-resolved from the graph on this request rather than from anything signed into the token — so a role change takes effect here on the next call instead of only after re-login. The body is bare (no success envelope). `capabilities` and `isPlatformStaff` are derived projections for UI gating; enforcement stays on the fine-grained `permissions` strings, and `roles` are display and audit only. The middleware also re-checks that the principal still exists in the graph and that its session is live, so a token minted before a user deletion or a logout is refused with 401 even though its signature is still good.",
  "inputSchema": {
    "type": "object",
    "properties": {}
  },
  "annotations": {
    "readOnlyHint": true,
    "openWorldHint": false
  }
}