The operator /me document identifies the human browser session, not a service agent. It returns the user's email, confirmation time, and workspaces reached through active memberships, including plan and status summaries.
User and current scope are different
The response lists workspaces the user may access, while most other operator endpoints act only on the session's current workspace. Seeing a workspace in /me does not make a current-workspace child URL valid until the application switches scope.
Human identity is not agent identity
Public /api/v1/agents/me is authenticated by a machine credential and returns its bound service agent. /api/v1/operator/me uses the browser cookie and returns the signed-in person.
Before you begin
A signed-in browser session with a selected workspace backed by an active membership is required; an archived workspace remains readable but rejects mutations. Every /api/v1/operator endpoint rejects API credentials and bearer tokens, regardless of their scopes.
The session must resolve both a user and a selected workspace through an active membership; a deprovisioned user with no such workspace receives 401. The selected workspace itself may be archived and remains readable.
Run the example on the same origin after signing in. Do not attach an API key or access-token Authorization header.
How it works
Confirm the session
Read /operator/me and compare id and email with the intended operator. Use the workspace summaries to identify the target by canonical UUID and status.
Establish workspace context
Switch through the product's workspace selector before calling scoped routes. Re-read /me or /operator/workspaces afterward rather than assuming a manually changed ID updated the session.
Examples
These examples are illustrative. Replace the sample values with your own.
Keep credentials in environment variables or a secret manager, never in client-side code.
Read the operator profile
This is the smallest way to verify that the browser has a usable operator session.
javascript
const response = await fetch("/api/v1/operator/me", {
credentials: "same-origin",
headers: {"Accept": "application/json"}
});
const body = await response.json();
if (!response.ok) throw new Error(`${response.status}: ${body.detail}`);
console.log(body);
What to expect
200 OK. The user object itself is returned, with id, email, confirmed_at, and workspaces; there is no top-level user wrapper.
Troubleshooting
The response is 401 while signed in elsewhere
The request must be same-origin so the correct session cookie is sent. Also confirm the session still has a selected workspace through an active membership; operator auth rejects a user-only scope.
A listed workspace's child route is 404
The workspace may be accessible but not current. Use the application switch action first; do not treat the workspaces array as authorization to bypass current scope.
Endpoint reference
Ready to integrate? Open an endpoint for its required permissions, request fields,
response format, and status codes. The examples above explain the workflow;
these details define each individual request.
GET
/api/v1/operator/me
Web Session
Get current user
Description
Returns the signed-in operator and the workspaces they can open. The user object itself is returned, with no top-level wrapper. Browser session only: like every /api/v1/operator route, a Bearer token (agk_ key or access token) gets 401.
