GET /api/session/scoped
Report the object scope of the calling session, if it has one.
Describes the calling session's own scope. It takes no parameters and can only ever
report on the credential presented in the Authorization header.
A session with no scope is not an error: it answers 200 with scoped: false. That
is the ordinary case -- the password, certificate and delegated logins all produce
unscoped sessions, and the object-scope check does not apply to them at all.
Authentication
Send the session id as Authorization: Bearer <session id>, and an RFC 9449 DPoP proof in the DPoP header if your session is bound to a key. The two are required together, not as alternatives — see Authenticating and Proving you hold your key.
There is no session cookie on any response and none is read on any request. Do not set credentials: "include" on a browser fetch.
Request
No request body.
Responses
200
The calling session's scope, or the fact that it has none.
variant
| Field | Type | Required | Description |
|---|---|---|---|
scoped | false (constant) | yes | |
detail | string | yes |
variant
| Field | Type | Required | Description |
|---|---|---|---|
scoped | true (constant) | yes | |
session | string | yes | |
actingAs | string | yes | |
objects | array of string | yes | |
expiresAt | string | yes | |
expiresInMs | integer | no | |
mintedAt | string | no | |
jkt | string | yes | |
mintedBy | string or null | no | The session that minted this credential. |
Example
{
"scoped": false,
"detail": "..."
}
401
No live session, or a DPoP proof that did not verify.
SESSION_NOT_FOUND -- the credential names no session this Gateway holds.
SESSION_EXPIRED -- it aged out. Both carry reauth: true; obtain a new credential
rather than retrying.
PROOF_* -- the sender constraint refused. See the DPoP section of this document for the
full table; PROOF_MALFORMED is a 400 and PROOF_REPLAY_CACHE_FULL a 503, and the
rest are here.
SCOPED_CREDENTIAL_EXPIRED -- a scoped browser credential passed its fixed lifetime. Use
does not extend it: an idle timeout would be refreshed by exactly the traffic a stolen
handle produces.
Error handling
Every failure answers JSON carrying at least code and detail. Match on code — detail is written for a human debugging the call and its wording is not part of the contract. See the error model.
| Status | Meaning |
|---|---|
401 | No live session, or a DPoP proof that did not verify. SESSION_NOT_FOUND -- the credential names no session this Gateway holds. SESSION_EXPIRED -- it aged out. Both carry reauth: true; obtain a new credential rather than retrying. PROOF_* -- the sender constraint refused. See the DPoP section of this document for the full table; PROOF_MALFORMED is a 400 and PROOF_REPLAY_CACHE_FULL a 503, and the rest are here. SCOPED_CREDENTIAL_EXPIRED -- a scoped browser credential passed its fixed lifetime. Use does not extend it: an idle timeout would be refreshed by exactly the traffic a stolen handle produces. |