> ## Documentation index
>
> Fetch the complete documentation index at: https://andesine.app/docs/llms.txt
> Use it to find all pages before you explore further.

# Verify a session token

`POST https://api.andesine.app/extensions/self/sessions/verify`

Verifies a session token from the extension frontend and returns its member. Tokens of other extensions, expired tokens, and tokens of an earlier extension generation fail with NOT_FOUND. checks evaluates collection and entry actions for the member, in collections the extension can read (restricted collections included), so the backend can authorize the member's request.

## Authentication

- `extensionToken` (http, bearer, JWT)

## Request body

The body is required.

Content type: `application/json`

- `token` (string, required)
- `checks` (array of object, optional)
  - `collectionID` (any of, required): Collection to check; null for the top level.
    - Any of: Option 1 (string)
    - Any of: Option 2 (null)
  - `actions` (array of any of, required): Collection and entry actions that the member must be able to take.
    - Any of: Option 1 (string). One of: `"collection:read"`, `"collection:create-child"`, `"collection:update"`, `"collection:move"`, `"collection:delete"`, `"collection:set-restricted"`, `"collection:manage-restricted-access"`, `"collection:set-publishing"`, `"publishing:publish-tree"`, `"publishing:unpublish-tree"`.
    - Any of: Option 2 (string). One of: `"entry:create"`, `"entry:read"`, `"entry:update"`, `"entry:move"`, `"entry:delete"`, `"version:read"`, `"version:create"`, `"version:update"`, `"version:revert"`, `"publishing:read"`, `"publishing:publish"`, `"publishing:unpublish"`.

## Responses

### 200

OK

Content type: `application/json`

- `workspaceID` (string, required)
- `workspacePlan` (string, required): The workspace's effective plan, e.g. free or pro; pro when the instance has no billing.
- `version` (string, required): The extension version the session was issued for.
- `member` (object, required)
  - `id` (string, required): ID of the membership.
  - `userID` (string, required): ID of the user.
  - `profile` (object, required)
    - `id` (string, required)
    - `name` (string, optional)
    - `image` (string, optional)
    - `email` (string, optional): Only with the read:memberships permission.
- `checks` (array of object, required): Results of the requested checks, in their order.
  - `collectionID` (any of, required)
    - Any of: Option 1 (string)
    - Any of: Option 2 (null)
  - `allowed` (boolean, required): Whether the member and the extension can take every action.
  - `denied` (array of any of, required): Actions that are not allowed.
    - Any of: Option 1 (string). One of: `"collection:read"`, `"collection:create-child"`, `"collection:update"`, `"collection:move"`, `"collection:delete"`, `"collection:set-restricted"`, `"collection:manage-restricted-access"`, `"collection:set-publishing"`, `"publishing:publish-tree"`, `"publishing:unpublish-tree"`.
    - Any of: Option 2 (string). One of: `"entry:create"`, `"entry:read"`, `"entry:update"`, `"entry:move"`, `"entry:delete"`, `"version:read"`, `"version:create"`, `"version:update"`, `"version:revert"`, `"publishing:read"`, `"publishing:publish"`, `"publishing:unpublish"`.

### 400

400

Content type: `application/json`

Type: one of.

- One of: Option 1 (object)
  - `defined` (constant, required): Value: `true`.
  - `code` (constant, required): Value: `"BAD_REQUEST"`.
  - `status` (constant, required): Value: `400`.
  - `message` (string, required): Default: `"Bad Request"`.
  - `data` (`ValidationErrorData`, optional)
    - `hints` (array of string, optional): Suggested next steps. Wording can change; use error codes and structured data for program logic.
    - `issues` (array of `ValidationIssue`, optional)
      - `message` (string, required)
      - `code` (string, optional)
      - `path` (array of any of, optional)
        - Any of: Option 1 (string)
        - Any of: Option 2 (number)
        - Any of: Option 3 (object)
          - `key` (any of, required)
            - Any of: Option 1 (string)
            - Any of: Option 2 (number)
- One of: Option 2 (object)
  - `defined` (constant, required): Value: `false`.
  - `code` (string, required)
  - `status` (number, required)
  - `message` (string, required)
  - `data` (any, optional)

### 401

401

Content type: `application/json`

Type: one of.

- One of: Option 1 (object)
  - `defined` (constant, required): Value: `true`.
  - `code` (constant, required): Value: `"UNAUTHORIZED"`.
  - `status` (constant, required): Value: `401`.
  - `message` (string, required): Default: `"Unauthorized"`.
  - `data` (`ErrorData`, optional)
    - `hints` (array of string, optional): Suggested next steps. Wording can change; use error codes and structured data for program logic.
- One of: Option 2 (object)
  - `defined` (constant, required): Value: `false`.
  - `code` (string, required)
  - `status` (number, required)
  - `message` (string, required)
  - `data` (any, optional)

### 403

403

Content type: `application/json`

Type: one of.

- One of: Option 1 (object)
  - `defined` (constant, required): Value: `true`.
  - `code` (constant, required): Value: `"FORBIDDEN"`.
  - `status` (constant, required): Value: `403`.
  - `message` (string, required): Default: `"Forbidden"`.
  - `data` (`ForbiddenErrorData`, optional)
    - `hints` (array of string, optional): Suggested next steps. Wording can change; use error codes and structured data for program logic.
    - `missingPermissions` (array of string, optional)
    - `requiredPlan` (constant, optional): Value: `"pro"`.
    - `action` (string, optional): The requested action that was denied.
- One of: Option 2 (object)
  - `defined` (constant, required): Value: `false`.
  - `code` (string, required)
  - `status` (number, required)
  - `message` (string, required)
  - `data` (any, optional)

### 404

404

Content type: `application/json`

Type: one of.

- One of: Option 1 (object)
  - `defined` (constant, required): Value: `true`.
  - `code` (constant, required): Value: `"NOT_FOUND"`.
  - `status` (constant, required): Value: `404`.
  - `message` (string, required): Default: `"Not Found"`.
  - `data` (`ErrorData`, optional)
- One of: Option 2 (object)
  - `defined` (constant, required): Value: `false`.
  - `code` (string, required)
  - `status` (number, required)
  - `message` (string, required)
  - `data` (any, optional)

### 409

409

Content type: `application/json`

Type: one of.

- One of: Option 1 (object)
  - `defined` (constant, required): Value: `true`.
  - `code` (constant, required): Value: `"CONFLICT"`.
  - `status` (constant, required): Value: `409`.
  - `message` (string, required): Default: `"Conflict"`.
  - `data` (`ErrorData`, optional)
- One of: Option 2 (object)
  - `defined` (constant, required): Value: `false`.
  - `code` (string, required)
  - `status` (number, required)
  - `message` (string, required)
  - `data` (any, optional)

### 429

429

Content type: `application/json`

Type: one of.

- One of: Option 1 (object)
  - `defined` (constant, required): Value: `true`.
  - `code` (constant, required): Value: `"TOO_MANY_REQUESTS"`.
  - `status` (constant, required): Value: `429`.
  - `message` (string, required): Default: `"Too Many Requests"`.
  - `data` (`RateLimitErrorData`, optional)
    - `hints` (array of string, optional): Suggested next steps. Wording can change; use error codes and structured data for program logic.
    - `limit` (string, optional): The limit that was reached: a short-term rate limit, or a monthly API call, AI credit, or spending limit. One of: `"rate"`, `"api-calls"`, `"ai-credits"`, `"spending"`.
    - `retryAfterSeconds` (number, optional): Minimum delay before another attempt, in seconds. Also sent in Retry-After.
- One of: Option 2 (object)
  - `defined` (constant, required): Value: `false`.
  - `code` (string, required)
  - `status` (number, required)
  - `message` (string, required)
  - `data` (any, optional)

### 500

500

Content type: `application/json`

Type: one of.

- One of: Option 1 (object)
  - `defined` (constant, required): Value: `true`.
  - `code` (constant, required): Value: `"INTERNAL_SERVER_ERROR"`.
  - `status` (constant, required): Value: `500`.
  - `message` (string, required): Default: `"Internal Server Error"`.
  - `data` (`ErrorData`, optional)
- One of: Option 2 (object)
  - `defined` (constant, required): Value: `false`.
  - `code` (string, required)
  - `status` (number, required)
  - `message` (string, required)
  - `data` (any, optional)

### 503

503

Content type: `application/json`

Type: one of.

- One of: Option 1 (object)
  - `defined` (constant, required): Value: `true`.
  - `code` (constant, required): Value: `"SERVICE_UNAVAILABLE"`.
  - `status` (constant, required): Value: `503`.
  - `message` (string, required): Default: `"Service Unavailable"`.
  - `data` (`ErrorData`, optional)
- One of: Option 2 (object)
  - `defined` (constant, required): Value: `false`.
  - `code` (string, required)
  - `status` (number, required)
  - `message` (string, required)
  - `data` (any, optional)