Current User API

GET /api/external/me returns the authenticated third-party user's profile in a stable external API shape. The response is filtered by the scopes granted to the OIDC access token.

Production endpoint URL: https://api.muhajirstudio.com/api/external/me.

Endpoint

GET /api/external/me
Authorization: Bearer ACCESS_TOKEN

Authentication is required. Cookie-only sessions are rejected; the endpoint accepts only OIDC bearer access tokens.

Required Scope

The endpoint requires openid.

If the access token is valid but does not include openid, the response is:

HTTP/1.1 403 Forbidden
Content-Type: application/json

{
  "error": "FORBIDDEN",
  "missingScopes": ["openid"]
}

Response Fields

The response always includes sub when openid is granted. Other fields are included only when the token has the matching scope.

Field	Type	Scope	Notes
sub	string	openid	Stable user identifier.
name	string	profile	User display name.
picture	string | null	profile	User profile image URL when available, otherwise null.
email	string	email	User email address.
emailVerified	boolean	email	Email verification status.
permissions	string[]	permissions	Effective permission keys filtered to known permissions.

Response schema:

{
  "sub": "user-id",
  "name": "Jane Doe",
  "picture": null,
  "email": "jane@example.com",
  "emailVerified": true,
  "permissions": ["manage-applications", "login-web-admin"]
}

Fields for scopes that were not granted are omitted, not returned as null, except picture, which can be null when profile is granted but no image exists.

Scope Examples

openid

{
  "sub": "user-id"
}

openid profile

{
  "sub": "user-id",
  "name": "Jane Doe",
  "picture": null
}

openid email

{
  "sub": "user-id",
  "email": "jane@example.com",
  "emailVerified": true
}

openid permissions

{
  "sub": "user-id",
  "permissions": ["manage-applications", "login-web-admin"]
}

Errors

Status	Error	Meaning
401	UNAUTHORIZED	Missing, malformed, expired, unknown, or userless bearer token.
403	FORBIDDEN	Valid bearer token is missing openid.
404	USER_NOT_FOUND	Token subject does not map to an existing user.
500	INTERNAL_ERROR	Unexpected lookup or response validation failure.

CORS

GET /api/external/me is covered by dynamic third-party CORS because it is under /api/external/*.

For browser clients:

• The browser origin must be registered in the application's allowedWebOrigins.
• Send the access token in Authorization: Bearer ACCESS_TOKEN.
• Do not rely on cookies; third-party CORS is non-credentialed.

When to Use This Endpoint

Use /api/external/me when a third-party application needs the current user's Muhajir Studio identity or profile after OIDC login.

Do not use /api/me/permissions or /api/me/access for third-party integrations. Those are first-party app/session APIs and are not the stable external current-user contract.