Account & Session

Four endpoints for working with an already-established identity — a company (via API key) or a logged-in user (via JWT). All four live-verified.

Whoami — works with either credential

GET /api/v1/me
Authorization: Bearer <either an API key or a user JWT>

The response shape depends entirely on which kind of token you send — detected from the token's own prefix, not a separate parameter.

Real response, API key:

{ "success": true, "companyId": "5d57f1a9-0ea0-452e-8161-ad0ae1376414" }

Real response, user JWT:

{ "success": true, "user": { "id": "274f4b7d-34cb-4770-941f-71f60681bd8b", "email": "user@example.com", "externalUserId": null } }

Get / update the current user

GET /api/v1/user
Authorization: Bearer <threshold1_jwt>

Real response:

{ "success": true, "user": { "id": "274f4b7d-34cb-4770-941f-71f60681bd8b", "email": "user@example.com", "externalUserId": null } }

PATCH /api/v1/user
Authorization: Bearer <threshold1_jwt>
Content-Type: application/json

{ "email": "new@example.com" }

Note the method is PATCH, not PUT — confirmed directly from the route's real exports, not assumed from convention. Real response:

{ "success": true, "user": { "id": "274f4b7d-34cb-4770-941f-71f60681bd8b", "email": "new@example.com" } }

DELETE /api/v1/user
Authorization: Bearer <threshold1_jwt>

Real response: { "success": true }. Live-verified — the account is genuinely gone; the same JWT is rejected on any subsequent call.

Session metadata

GET /api/v1/session
Authorization: Bearer <threshold1_jwt>

Real response:

{ "success": true, "session": { "userId": "274f4b7d-34cb-4770-941f-71f60681bd8b", "issuedAt": 1787680435, "expiresAt": 1788285235 } }

Logout

POST /api/v1/logout
Authorization: Bearer <threshold1_jwt>

Real response: { "success": true }. Live-verified as genuinely invalidating: the same token used against /session immediately afterward returns a real captured error:

{ "success": false, "error": "Invalid or expired session", "code": "INVALID_SESSION" }

401

What's next

External User ID Bridging — how externalUserId shows up across these responses.