Behavior Notes
- Endpoint path: /auth/user/me
- Strict auth: BOTH X-Bridge-Secret and session (cookie or X-Session-ID).
- /auth/me is legacy (getCurrentUserLegacy); same formatter for user fields.
- User includes business + privacy fields when columns exist; acquisition_ and team_size_range are never returned* (write-only via onboarding complete).
- Privacy-focused read: Get privacy.
- Writes: Complete onboarding, Update profile (biz), privacy routes.
Get Current User
GET
/auth/user/me
Get current authenticated user/session state. Requires BOTH X-Bridge-Secret and a valid session (cookie or X-Session-ID). Returns login-compatible shape. User includes business + privacy fields when module columns exist; acquisition_* and team_size_range are never returned (write-only via onboarding complete).
Authorizations
SessionAuth
Session ID for authenticated requests
Type
API Key (header: X-Session-ID)
BridgeSecret
Bridge secret for backend integration
Type
API Key (header: X-Bridge-Secret)
Responses
Current session resolved (full session or pending 2FA)
application/json
JSON "success": true, "user": { "id": "usr_8f3k2m1q9", "email": "user@example.com", "name": "User", "last_name": "Example", "user_name": "userexample", "user_type": "admin", "picture": "https://cdn.example.com/profiles/user-example.jpg", "is_verified": true, "two_factor": true, "lang": "es", "metadata": { }, "tmz": null, "dob": null, "display_name": null, "first_time": false, "gender": null }, "sessionId": "ses_live_abc123xyz890", "expiresAt": "2026-05-06T18:49:00.930Z"
{
}