Validate current authentication token, and disclose what it may do.
Also reports how the request authenticated, which KIND of credential it is, the organization the credential is acting in, and — for an organization API key that declares them — the scopes the key is restricted to. This endpoint is always reachable by any valid credential, whatever its scopes, so the holder of a key can always read what it may do.
A personal session that has been signed out or revoked — for example with POST /v1/auth/logout or Revoke one of my sessions — is refused with 401 TOKEN_INVALID and details.reason "session_family_revoked", even while its access token has not yet expired. Treat that answer as signed out: refreshing will not bring the session back, so sign in again. API keys and other non-session credentials are answered from the credential alone.
is_valid boolean
Whether the token is valid
error string or null
Error message if invalid
requires_reconnect boolean or null
Whether re-authentication is required
auth_method string or null
How the request authenticated internally: api_key for an organization API key, user for anything user-backed. Two materially different credentials share user — a session token and a user API key — so read credential_kind to tell them apart
credential_kind string or null
Which kind of credential this is: organization_api_key (an organization key, revocable on its own), classic_api_key (an organization key that acts as a person, with that person's live permissions), user_api_key (a key that inherits a user's permissions and carries its own separate scope vocabulary, which this endpoint does not report), or user_session (a sign-in token — revoking it signs the user out)
organization_id string or null
Organization this credential is acting in, if resolved
scopes array of strings or null
Scopes the presenting organization API key is restricted to, and only ever that. A non-empty list is enforced on every request: an operation outside those scopes is refused with 403 API_KEY_SCOPE_FORBIDDEN. null does not mean "unrestricted" on its own — it means unrestricted only when credential_kind is organization_api_key or classic_api_key (a key that acts as a person never reaches above that person). For any other credential kind the field does not apply and says nothing about what that credential may do
acts_as string or null
For an organization API key: user when it acts as a person (credential_kind is classic_api_key), organization when it acts as the organization. null for every other credential.
acting_user_id string or null
The person a key with acts_as: "user" acts as (usr_...); null otherwise.
| Status | Code | When |
|---|---|---|
| 401 | AUTHENTICATION_REQUIRED | No API key, access token or session cookie was sent. |
| 401 | TOKEN_INVALID | The credential is invalid. With details.reason "session_family_revoked": the personal session was signed out or revoked, even though its access token has not yet expired. Sign in again. |
- Bash
- Python
- Python
- JavaScript
curl -X GET "https://api.aitronos.com/v1/auth/validate" \
-H "X-API-Key: $FREDDY_API_KEY"Response:
{
"is_valid": true,
"error": "example_error",
"requires_reconnect": false
}