Skip to main content
GET
Current user, workspace and role

Authorizations

hookie_session
string
cookie
required

The console's sealed session cookie, set by WorkOS AuthKit. Mutating requests also require the X-Requested-With CSRF header.

Response

The signed-in user, the resolved workspace (tenant) and the caller effective role. workspaceSlug is the first path segment of a public webhook URL. workspaceName is the workspace's display name, set in Settings → Workspace (PATCH /admin/api/workspace).

user
object
required
tenantId
string
required
role
enum<string>
required

For an OAuth-connected agent this is the membership role already clipped to the granted scopes.

Available options:
owner,
admin,
developer,
viewer,
member
plan
enum<string>
required
Available options:
free,
starter,
standard,
team
workspaceSlug
string | null
required
workspaceName
string | null
required

The workspace's display name.

platform_admin
boolean
required
signInMethod
enum<string> | null
required

How this console session was signed in (SEC-12, #314), from the sealed WorkOS session. null for an OAuth agent or an admin API key, which do not sign in, and when WorkOS did not record a method. It names the first factor only: whether a second factor ran is not recorded in the session.

Available options:
email_code,
github,
google,
sso,
password,
passkey,
other,
null
workspaceStatus
enum<string>
required

suspended while the workspace is suspended: reads work, and writes other than billing answer 403 workspace_suspended.

Available options:
active,
suspended
workspaceClosure
object | null
required

Set while the owner's closure is pending (the workspace is also suspended); null otherwise.

retentionGrace
object | null
required

Set for 7 days after a downgrade that shortened the workspace's retention: until ends_at the previous plan's retention still applies, and after it data older than the current plan's retention is deleted. Null otherwise.

googleWorkspaceDomain
string | null
required

The Google Workspace domain (Google's hd) Google verified for this console session's Google sign-in (#326). null for any other sign-in, a personal Google account, an agent or an API key, and where the WorkOS environment does not return Google's OAuth tokens.

googleWorkspaceNotice
object | null
required

Set when this Google sign-in's domain is linked to a workspace the person could not join because it is at its plan's member limit (#326); null otherwise.

api_key
object

Present only when the call was made with an admin API key: which key, and the one project it is limited to (null for every project).

agent_account
object | null

Set when an AI agent registered this workspace itself (#331): which agent, and whether a person has claimed it. Null for every other workspace.

is_agent_account
enum<boolean>

Present only when the caller is the self-registered agent itself, before a person claims the workspace (#331).

Available options:
true