GET /api/v1/internal/session
Read internal staff access
Returns no staff or client identifiers to ordinary customers. Staff membership and explicit client assignments are server-owned and revocable.
Internal staff surface. Client data is restricted to explicit server-owned customer assignments; inaccessible resources return 404. Product/channel entitlements also apply.
Requires a verified Supabase human web session and active, revocable database-owned staff membership. Customer operator permissions, request headers and delegated agents cannot grant staff access. The session endpoint returns access:false to nonstaff without staff or customer identifiers.
Request
HTTP
GET /api/v1/internal/sessionUse the configured API origin. Private requests require a verified Bearer credential; an agent mutation can additionally require exact approval headers. Authentication guide →
Responses
Reference schemas resolve through the downloadable OpenAPI components. The specification marks unmodeled success payloads; an unrestricted payload is not a promise that arbitrary fields exist.
400Invalid request or unsupported fields
Response contract
{
"description": "Invalid request or unsupported fields",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
}401Missing or invalid authentication
Response contract
{
"description": "Missing or invalid authentication",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
}403Permission or product scope refused
Response contract
{
"description": "Permission or product scope refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
}404Route or tenant-scoped resource not found
Response contract
{
"description": "Route or tenant-scoped resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
}409State, revision, approval, funding or idempotency conflict
Response contract
{
"description": "State, revision, approval, funding or idempotency conflict",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
}422Supplier configuration, capability or upstream refusal
Response contract
{
"description": "Supplier configuration, capability or upstream refusal",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
}429Rate limit reached; wait before retrying
Response contract
{
"description": "Rate limit reached; wait before retrying",
"headers": {
"x-ratelimit-limit": {
"description": "Maximum requests permitted in the current rate-limit window.",
"schema": {
"type": "integer"
}
},
"x-ratelimit-remaining": {
"description": "Requests remaining in the current window.",
"schema": {
"type": "integer"
}
},
"x-ratelimit-reset": {
"description": "Seconds until the current rate-limit window resets.",
"schema": {
"type": "integer"
}
},
"retry-after": {
"description": "Minimum seconds to wait before retrying.",
"schema": {
"type": "integer"
}
}
},
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
}500Internal error; inspect state before retrying a mutation
Response contract
{
"description": "Internal error; inspect state before retrying a mutation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
}503Dependency or authentication verifier unavailable
Response contract
{
"description": "Dependency or authentication verifier unavailable",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
}2XXSuccessful response.
Response contract
{
"description": "Successful response.",
"headers": {
"x-ratelimit-limit": {
"description": "Maximum requests permitted in the current rate-limit window.",
"schema": {
"type": "integer"
}
},
"x-ratelimit-remaining": {
"description": "Requests remaining in the current window.",
"schema": {
"type": "integer"
}
},
"x-ratelimit-reset": {
"description": "Seconds until the current rate-limit window resets.",
"schema": {
"type": "integer"
}
}
},
"content": {
"application/json": {
"schema": {
"anyOf": [
{
"type": "object",
"properties": {
"access": {
"type": "boolean",
"const": false
}
},
"required": [
"access"
],
"additionalProperties": false
},
{
"type": "object",
"properties": {
"access": {
"type": "boolean",
"const": true
},
"staff": {
"type": "object",
"properties": {
"id": {
"type": "string",
"minLength": 1
},
"userId": {
"type": "string",
"format": "uuid"
},
"name": {
"type": "string"
}
},
"required": [
"id",
"userId",
"name"
],
"additionalProperties": false
},
"clients": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string",
"minLength": 1
},
"name": {
"type": "string"
}
},
"required": [
"id",
"name"
],
"additionalProperties": false
}
},
"assignees": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string",
"minLength": 1
},
"userId": {
"type": "string",
"format": "uuid"
},
"name": {
"type": "string"
},
"advertiserIds": {
"type": "array",
"items": {
"type": "string",
"minLength": 1
}
}
},
"required": [
"id",
"userId",
"name",
"advertiserIds"
],
"additionalProperties": false
}
},
"billing": {
"type": "object",
"properties": {
"paidActionsEnabled": {
"type": "boolean"
},
"mode": {
"type": "string",
"enum": [
"disabled",
"sandbox",
"stripe",
"stripe-test",
"pilot"
]
}
},
"required": [
"paidActionsEnabled",
"mode"
],
"additionalProperties": false
}
},
"required": [
"access",
"staff",
"clients",
"assignees",
"billing"
],
"additionalProperties": false
}
]
}
}
}
}Operation constraints
Machine-readable metadata
{
"x-response-schema-completeness": "modeled",
"x-rate-limit": {
"requests": 300,
"windowMilliseconds": 60000,
"key": "request IP",
"headers": [
"x-ratelimit-limit",
"x-ratelimit-remaining",
"x-ratelimit-reset"
]
},
"x-idempotency": {
"policy": "not-generalized",
"note": "There is no universal Idempotency-Key middleware. Only the documented endpoint mechanisms protect retries."
},
"x-human-only": true,
"x-required-human-permissions": [],
"x-internal-staff-only": true,
"x-staff-authority": "server-owned revocable membership and explicit client assignments"
}Complete operation
OpenAPI
{
"operationId": "get_api_v1_internal_session",
"summary": "Read internal staff access",
"description": "Returns no staff or client identifiers to ordinary customers. Staff membership and explicit client assignments are server-owned and revocable.\n\nInternal staff surface. Client data is restricted to explicit server-owned customer assignments; inaccessible resources return 404. Product/channel entitlements also apply.\n\nRequires a verified Supabase human web session and active, revocable database-owned staff membership. Customer operator permissions, request headers and delegated agents cannot grant staff access. The session endpoint returns access:false to nonstaff without staff or customer identifiers.",
"tags": [
"Internal"
],
"security": [
{
"bearerAuth": []
}
],
"parameters": [],
"responses": {
"400": {
"description": "Invalid request or unsupported fields",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
},
"401": {
"description": "Missing or invalid authentication",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
},
"403": {
"description": "Permission or product scope refused",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
},
"404": {
"description": "Route or tenant-scoped resource not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
},
"409": {
"description": "State, revision, approval, funding or idempotency conflict",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
},
"422": {
"description": "Supplier configuration, capability or upstream refusal",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
},
"429": {
"description": "Rate limit reached; wait before retrying",
"headers": {
"x-ratelimit-limit": {
"description": "Maximum requests permitted in the current rate-limit window.",
"schema": {
"type": "integer"
}
},
"x-ratelimit-remaining": {
"description": "Requests remaining in the current window.",
"schema": {
"type": "integer"
}
},
"x-ratelimit-reset": {
"description": "Seconds until the current rate-limit window resets.",
"schema": {
"type": "integer"
}
},
"retry-after": {
"description": "Minimum seconds to wait before retrying.",
"schema": {
"type": "integer"
}
}
},
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
},
"500": {
"description": "Internal error; inspect state before retrying a mutation",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
},
"503": {
"description": "Dependency or authentication verifier unavailable",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
},
"2XX": {
"description": "Successful response.",
"headers": {
"x-ratelimit-limit": {
"description": "Maximum requests permitted in the current rate-limit window.",
"schema": {
"type": "integer"
}
},
"x-ratelimit-remaining": {
"description": "Requests remaining in the current window.",
"schema": {
"type": "integer"
}
},
"x-ratelimit-reset": {
"description": "Seconds until the current rate-limit window resets.",
"schema": {
"type": "integer"
}
}
},
"content": {
"application/json": {
"schema": {
"anyOf": [
{
"type": "object",
"properties": {
"access": {
"type": "boolean",
"const": false
}
},
"required": [
"access"
],
"additionalProperties": false
},
{
"type": "object",
"properties": {
"access": {
"type": "boolean",
"const": true
},
"staff": {
"type": "object",
"properties": {
"id": {
"type": "string",
"minLength": 1
},
"userId": {
"type": "string",
"format": "uuid"
},
"name": {
"type": "string"
}
},
"required": [
"id",
"userId",
"name"
],
"additionalProperties": false
},
"clients": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string",
"minLength": 1
},
"name": {
"type": "string"
}
},
"required": [
"id",
"name"
],
"additionalProperties": false
}
},
"assignees": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string",
"minLength": 1
},
"userId": {
"type": "string",
"format": "uuid"
},
"name": {
"type": "string"
},
"advertiserIds": {
"type": "array",
"items": {
"type": "string",
"minLength": 1
}
}
},
"required": [
"id",
"userId",
"name",
"advertiserIds"
],
"additionalProperties": false
}
},
"billing": {
"type": "object",
"properties": {
"paidActionsEnabled": {
"type": "boolean"
},
"mode": {
"type": "string",
"enum": [
"disabled",
"sandbox",
"stripe",
"stripe-test",
"pilot"
]
}
},
"required": [
"paidActionsEnabled",
"mode"
],
"additionalProperties": false
}
},
"required": [
"access",
"staff",
"clients",
"assignees",
"billing"
],
"additionalProperties": false
}
]
}
}
}
}
},
"x-response-schema-completeness": "modeled",
"x-rate-limit": {
"requests": 300,
"windowMilliseconds": 60000,
"key": "request IP",
"headers": [
"x-ratelimit-limit",
"x-ratelimit-remaining",
"x-ratelimit-reset"
]
},
"x-idempotency": {
"policy": "not-generalized",
"note": "There is no universal Idempotency-Key middleware. Only the documented endpoint mechanisms protect retries."
},
"x-human-only": true,
"x-required-human-permissions": [],
"x-internal-staff-only": true,
"x-staff-authority": "server-owned revocable membership and explicit client assignments"
}