Session

Inspect authenticated operator, scopes, and bearer token context.

Path

GET /api/operator/auth/session

Required input: bearer Authorization header. There are no query parameters and no request body. No additional scope is required beyond a valid operator API key or staff session.

Response fields

Top-level:

• auth_type: api_key or staff
• scopes

Operator:

• id
• slug
• name
• status
• currency_code
• balance_adapter_type
• timezone
• default_locale
• allow_partial_share_sell: current Polynion Admin-controlled boolean; defaults to false. When false, Opinion sells must close the full selected-outcome holding. Read-only for operators.

API key, when auth_type = api_key:

• id
• name
• key_id
• key_prefix
• scopes
• last4
• revoked_at

Staff, when auth_type = staff:

• admin_user_id
• email
• display_name
• role
• status
• must_change_password
• scopes

The response always includes both api_key and staff; the unused branch is null. Staff scopes are the current effective membership scopes. This route returns no raw key/session token and no enabled_products field; do not infer product enablement from scopes alone.

Use cases

• verify operator config bound to current key
• debug wrong scope issues
• confirm simulator vs rest_v1 adapter mode
• confirm whether a dashboard request is using API-key auth or staff-session auth