Verify a session token

post

https://api.andesine.app/extensions/self/sessions/verify

Verifies a session token from the extension frontend and returns its member. Tokens of other extensions, expired tokens, and tokens of an earlier extension generation fail with NOT_FOUND. checks evaluates collection and entry actions for the member, in collections the extension can read (restricted collections included), so the backend can authorize the member's request.

Authentication

extensionTokenhttp, bearer, JWT

An extension JWT signed with the extension's registered key: iss is the registry name, sub the ext_ ID (omitted for app-level operations), aud the instance API URL, and exp at most 5 minutes after iat.

Request body *

application/json

Bodyobject

2 fields

token*string

checksarray of object

2 fields

collectionID*any of

Collection to check; null for the top level

Options

Any of

Option 1string

Option 2null

actions*array of any of

Collection and entry actions that the member must be able to take

Options

Any of

Option 1string

One of: "collection:read", "collection:create-child", "collection:update", "collection:move", "collection:delete", "collection:set-restricted", "collection:manage-restricted-access", "collection:set-publishing", "publishing:publish-tree", "publishing:unpublish-tree"

Option 2string

One of: "entry:create", "entry:read", "entry:update", "entry:move", "entry:delete", "version:read", "version:create", "version:update", "version:revert", "publishing:read", "publishing:publish", "publishing:unpublish"

Responses

200OKapplication/json

Bodyobject

5 fields

workspaceID*string

workspacePlan*string

The workspace's effective plan, e.g. free or pro; pro when the instance has no billing

version*string

The extension version the session was issued for

member*object

3 fields

id*string

ID of the membership

userID*string

ID of the user

profile*object

4 fields

id*string

namestring

imagestring

emailstring

Only with the read:memberships permission

checks*array of object

Results of the requested checks, in their order

3 fields

collectionID*any of

Options

Any of

Option 1string

Option 2null

allowed*boolean

Whether the member and the extension can take every action

denied*array of any of

Actions that are not allowed

Options

Any of

Option 1string

Option 2string

400Bad Requestapplication/json

Bodyone of

Options

One of

Option 1object

defined*constant

Value: true

code*constant

Value: "BAD_REQUEST"

status*constant

Value: 400

message*string

Default: "Bad Request"

dataValidationErrorData

2 fields

hintsarray of string

Suggested next steps. Wording can change; use error codes and structured data for program logic.

issuesarray of ValidationIssue

3 fields

message*string

codestring

patharray of any of

Options

Any of

Option 1string

Option 2number

Option 3object

key*any of

Options

Any of

Option 1string

Option 2number

Option 2object

defined*constant

Value: false

code*string

status*number

message*string

dataany

401Unauthorizedapplication/json

Bodyone of

Options

One of

Option 1object

defined*constant

Value: true

code*constant

Value: "UNAUTHORIZED"

status*constant

Value: 401

message*string

Default: "Unauthorized"

dataErrorData

1 field

hintsarray of string

Suggested next steps. Wording can change; use error codes and structured data for program logic.

Option 2object

defined*constant

Value: false

code*string

status*number

message*string

dataany

403Forbiddenapplication/json

Bodyone of

Options

One of

Option 1object

defined*constant

Value: true

code*constant

Value: "FORBIDDEN"

status*constant

Value: 403

message*string

Default: "Forbidden"

dataForbiddenErrorData

4 fields

hintsarray of string

Suggested next steps. Wording can change; use error codes and structured data for program logic.

missingPermissionsarray of string

requiredPlanconstant

Value: "pro"

actionstring

The requested action that was denied

Option 2object

defined*constant

Value: false

code*string

status*number

message*string

dataany

404Not Foundapplication/json

Bodyone of

Options

One of

Option 1object

defined*constant

Value: true

code*constant

Value: "NOT_FOUND"

status*constant

Value: 404

message*string

Default: "Not Found"

dataErrorData

1 field

hintsarray of string

Suggested next steps. Wording can change; use error codes and structured data for program logic.

Option 2object

defined*constant

Value: false

code*string

status*number

message*string

dataany

409Conflictapplication/json

Bodyone of

Options

One of

Option 1object

defined*constant

Value: true

code*constant

Value: "CONFLICT"

status*constant

Value: 409

message*string

Default: "Conflict"

dataErrorData

1 field

hintsarray of string

Suggested next steps. Wording can change; use error codes and structured data for program logic.

Option 2object

defined*constant

Value: false

code*string

status*number

message*string

dataany

429Too Many Requestsapplication/json

Bodyone of

Options

One of

Option 1object

defined*constant

Value: true

code*constant

Value: "TOO_MANY_REQUESTS"

status*constant

Value: 429

message*string

Default: "Too Many Requests"

dataRateLimitErrorData

3 fields

hintsarray of string

Suggested next steps. Wording can change; use error codes and structured data for program logic.

limitstring

The limit that was reached: a short-term rate limit, or a monthly API call, AI credit, or spending limit

One of: "rate", "api-calls", "ai-credits", "spending"

retryAfterSecondsnumber

Minimum delay before another attempt, in seconds. Also sent in Retry-After.

Option 2object

defined*constant

Value: false

code*string

status*number

message*string

dataany

500Internal Server Errorapplication/json

Bodyone of

Options

One of

Option 1object

defined*constant

Value: true

code*constant

Value: "INTERNAL_SERVER_ERROR"

status*constant

Value: 500

message*string

Default: "Internal Server Error"

dataErrorData

1 field

hintsarray of string

Suggested next steps. Wording can change; use error codes and structured data for program logic.

Option 2object

defined*constant

Value: false

code*string

status*number

message*string

dataany

503Service Unavailableapplication/json

Bodyone of

Options

One of

Option 1object

defined*constant

Value: true

code*constant

Value: "SERVICE_UNAVAILABLE"

status*constant

Value: 503

message*string

Default: "Service Unavailable"

dataErrorData

1 field

hintsarray of string

Suggested next steps. Wording can change; use error codes and structured data for program logic.

Option 2object

defined*constant

Value: false

code*string

status*number

message*string

dataany

Request

bash

curl --request POST \
  --url 'https://api.andesine.app/extensions/self/sessions/verify' \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data-raw '{
  "token": "string",
  "checks": [
    {
      "collectionID": "string",
      "actions": [
        "collection:read"
      ]
    }
  ]
}'

javascript

const response = await fetch("https://api.andesine.app/extensions/self/sessions/verify", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "token": "string",
    "checks": [
      {
        "collectionID": "string",
        "actions": [
          "collection:read"
        ]
      }
    ]
  })
});

const data = await response.json();

python

import requests

response = requests.post(
    "https://api.andesine.app/extensions/self/sessions/verify",
    headers={
        "Authorization": "Bearer <token>",
        "Content-Type": "application/json",
    },
    json={
        "token": "string",
        "checks": [
            {
                "collectionID": "string",
                "actions": [
                    "collection:read",
                ],
            },
        ],
    },
)

print(response.json())

Response

json

{
  "workspaceID": "string",
  "workspacePlan": "string",
  "version": "string",
  "member": {
    "id": "string",
    "userID": "string",
    "profile": {
      "id": "string",
      "name": "string",
      "image": "string",
      "email": "string"
    }
  },
  "checks": [
    {
      "collectionID": "string",
      "allowed": true,
      "denied": [
        "collection:read"
      ]
    }
  ]
}

json

{
  "defined": true,
  "code": "BAD_REQUEST",
  "status": 400,
  "message": "Bad Request",
  "data": {
    "hints": [
      "string"
    ],
    "issues": [
      {
        "message": "string",
        "code": "string",
        "path": [
          "string"
        ]
      }
    ]
  }
}

json

{
  "defined": true,
  "code": "UNAUTHORIZED",
  "status": 401,
  "message": "Unauthorized",
  "data": {
    "hints": [
      "string"
    ]
  }
}

json

{
  "defined": true,
  "code": "FORBIDDEN",
  "status": 403,
  "message": "Forbidden",
  "data": {
    "hints": [
      "string"
    ],
    "missingPermissions": [
      "string"
    ],
    "requiredPlan": "pro",
    "action": "string"
  }
}

json

{
  "defined": true,
  "code": "NOT_FOUND",
  "status": 404,
  "message": "Not Found",
  "data": {
    "hints": [
      "string"
    ]
  }
}

json

{
  "defined": true,
  "code": "CONFLICT",
  "status": 409,
  "message": "Conflict",
  "data": {
    "hints": [
      "string"
    ]
  }
}

json

{
  "defined": true,
  "code": "TOO_MANY_REQUESTS",
  "status": 429,
  "message": "Too Many Requests",
  "data": {
    "hints": [
      "string"
    ],
    "limit": "rate",
    "retryAfterSeconds": 0
  }
}

json

{
  "defined": true,
  "code": "INTERNAL_SERVER_ERROR",
  "status": 500,
  "message": "Internal Server Error",
  "data": {
    "hints": [
      "string"
    ]
  }
}

json

{
  "defined": true,
  "code": "SERVICE_UNAVAILABLE",
  "status": 503,
  "message": "Service Unavailable",
  "data": {
    "hints": [
      "string"
    ]
  }
}