Get my Auth profile

Read the caller's current Auth identity, context, and optional service permissions.

Outcome

Read the caller's current Auth identity, context, and optional service permissions.

Examples below are complete responses from the isolated Auth handler with explicit token/repository/flag simulations.

Before you start

Verify the intended human/agent identity and exact pinned credential context. This read does not switch context or select another user.
Discover a canonical application id before adding appId. The returned profile is an identity projection, so target application actions and resource options still provide final authority.
Retain sanitized response/request evidence when supporting data is absent or a read fails. Do not treat every HTTP 401 as proof of OAuth expiry.

Discover the identity and application

topolo whoami --json
topolo context ls --json
topolo apps --json
topolo actions get app_topolo_auth.me.get --detail --json

Input fields

Field	Required	Meaning
`appId`	No	Optional canonical application id discovered through the credential-scoped catalog. Requests its current permission/context and workspace-policy projection; omitting it does not list every application permission.

Omit appId with {} for the identity projection. There is no userId, organization override or workspace selector in this input.

Response fields

The successful envelope has success=true, message, data.user and an ISO timestamp. A refusal has success=false and error instead. Known user fields are listed below; context/settings payloads retain their owning repository shapes.

Field in data.user	Meaning
`id`	Authenticated stored principal id; compare to the same pinned identity.
`email`	Current profile email; independent of the personal recovery address.
`name`	Stored display name when present.
`profilePicture`	Current public photo URL or null; see the separate avatar actions for mutation and cache rules.
`orgId`	Effective organization id in the released credential context, or null.
`orgSlug`	Effective organization slug, or null.
`role`	Projected context/consent role when present; it does not itself authorize a target action.
`permissions`	Selected application permissions for context-RBAC, string consent claims for other credential-bound OAuth, or an empty array when no application is evaluated.
`principalType`	Stored principal classification when present.
`principalServices`	Stored principal service declarations when present; still subject to target authorization.
`launcherEligible`	Launcher projection when present.
`releaseCapabilities`	enabled and flagsAvailable describe released product capabilities; they are separate from permissions.
`activeContextType`	Released organization/personal/household context type, or null.
`activeContextId`	Released active context identifier, or null.
`activeContext`	Released active context projection, or null.
`availableContexts`	Released context projections; this array does not switch a pinned credential.
`organizationMemberships`	Organization membership projections.
`householdMemberships`	Released household memberships.
`membershipSummary`	Organization/household arrays plus repository-owned summary extensions.
`householdId`	Released household id, or null.
`householdSlug`	Released household slug, or null.
`selectedHouseholdId`	Released household selection, or null.
`selectedHousehold`	Released selected household projection, or null.
`workspaceResourceAccess`	Selector-policy projection with optional resourceType/label and management mode; use a published workspace/options action to resolve the concrete authorized target.
`personalRecoveryEmail`	Recovery-email record or null. verifiedAt, loginEnabled and recoveryEnabled have distinct meanings; no delivery proof is included.
`recoveryEmailRequired`	True when no truthy verifiedAt exists on the recovery record.
`passwordConfigured`	True only when the stored projection says a password is configured.
`status`	Stored account status when present.
`createdAt`	Stored creation epoch seconds when present.
`lastLoginAt`	Stored last login epoch seconds/null when present.
`organization`	Organization/settings/entitlement and selected-app onboarding projection, or null. Reduced data is possible when supporting reads fail.

Interpret the response

A surface credential returns only its bounded account profile and fresh application resource projection. Supply its exact appId (or browser X-App-ID header). It never hydrates the stored organization role, returns organization-wide permissions, changes context or grants workspace access. Generic Auth administration rejects surface credentials; work operations must resolve their exact resource independently.

data.user identifies the authenticated principal’s stored profile. This read never selects another user, changes the stored browser preference, grants application membership or creates a workspace.

Credential-bound OAuth uses its token organization even when the hydrated user row has a different browser preference. Context-RBAC OAuth evaluates the selected application’s permissions in that bound context; other credential-bound OAuth returns only string permission claims from its consent token. An empty permission array without appId is not proof of having no access.

The optional appId first requires released context and application access for an ordinary principal. Verified platform authority can bypass that membership gate. Role alone is not a per-action authorization decision; discover the target action and its resource options separately.

releaseCapabilities gates the public projection of personal and household contexts. A dark capability can yield null active context and empty released context arrays while the underlying identity still exists. Organization, household and membership projections do not authorize switching a pinned credential.

profilePicture is the current photo URL or null. passwordConfigured and recoveryEmailRequired are independent signals; recoveryEmailRequired reflects absence of a truthy verifiedAt. A recovery-email record does not prove recipient delivery.

organization.settings and appEntitlement may be empty/null when the supporting organization lookup fails or settings cannot be parsed. organization.onboardingCompletedAt can be null without proving onboarding was never completed. workspaceResourceAccess describes selector policy; it does not resolve a target or prove a mutation will succeed.

The handler currently reports invalid credentials and caught supporting-store failures as HTTP 401 AUTH_ERROR. Preserve the exact response and request id; one such result is not proof that OAuth expired. Missing stored users are HTTP 404 and denied application context/access is HTTP 403.

Worked examples

All ids and addresses are synthetic fixtures. Resolve the current identity/application before validating and planning the unchanged read. Cookie and OAuth fixture cases describe the handler’s transport/claim setup; your CLI/MCP connection supplies its own credential and cannot select those fixture identities. The full target responses below do not prove live gateway or provider parity.

Read the current human profile without an application selector

Input · payload.json:

{}

CLI:

topolo actions validate app_topolo_auth.me.get --data @payload.json --json
topolo actions plan app_topolo_auth.me.get --data @payload.json --json
topolo actions call app_topolo_auth.me.get --data @payload.json --detail --json

MCP read after topolo_validate_action and topolo_plan_action on the same input:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_auth.me.get",
    "input": {}
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "User info retrieved successfully",
  "data": {
    "user": {
      "id": "usr_profile_fixture",
      "email": "profile@example.test",
      "name": "Fixture human",
      "profilePicture": null,
      "orgId": "org_profile_fixture",
      "orgSlug": "profile-fixture",
      "householdId": null,
      "householdSlug": null,
      "selectedHouseholdId": null,
      "selectedHousehold": null,
      "role": "member",
      "permissions": [],
      "principalType": "human",
      "principalServices": [],
      "launcherEligible": true,
      "releaseCapabilities": {
        "enabled": [],
        "flagsAvailable": true
      },
      "activeContextType": "organization",
      "activeContextId": "org_profile_fixture",
      "activeContext": {
        "id": "org_profile_fixture",
        "name": "Fixture organization",
        "slug": "profile-fixture",
        "role": "member"
      },
      "availableContexts": [
        {
          "type": "organization",
          "id": "org_profile_fixture",
          "name": "Fixture organization",
          "slug": "profile-fixture",
          "role": "member"
        }
      ],
      "organizationMemberships": [
        {
          "id": "org_profile_fixture",
          "name": "Fixture organization",
          "slug": "profile-fixture",
          "role": "member"
        }
      ],
      "householdMemberships": [],
      "membershipSummary": {
        "organizations": [
          {
            "id": "org_profile_fixture",
            "name": "Fixture organization",
            "slug": "profile-fixture",
            "role": "member"
          }
        ],
        "households": []
      },
      "workspaceResourceAccess": null,
      "personalRecoveryEmail": {
        "id": "uem_profile_fixture",
        "userId": "usr_profile_fixture",
        "email": "recovery@example.test",
        "kind": "personal_recovery",
        "organizationId": null,
        "verifiedAt": 3,
        "verificationExpiresAt": null,
        "loginEnabled": false,
        "recoveryEnabled": true,
        "createdAt": 1,
        "updatedAt": 3
      },
      "recoveryEmailRequired": false,
      "passwordConfigured": true,
      "status": "active",
      "createdAt": 1,
      "lastLoginAt": 2,
      "organization": {
        "id": "org_profile_fixture",
        "name": "Fixture organization",
        "slug": "profile-fixture",
        "settings": {
          "appEntitlement": {
            "mode": "count",
            "paidAppCount": 2,
            "appSlugs": [
              "docs"
            ]
          }
        },
        "appEntitlement": {
          "mode": "count",
          "paidAppCount": 2,
          "appSlugs": [
            "docs"
          ]
        },
        "onboardingCompletedAt": null
      }
    }
  },
  "timestamp": "2026-10-03T00:00:00.000Z"
}

Input · payload.json:

{
  "appId": "app_topolo_docs"
}

CLI:

topolo actions validate app_topolo_auth.me.get --data @payload.json --json
topolo actions plan app_topolo_auth.me.get --data @payload.json --json
topolo actions call app_topolo_auth.me.get --data @payload.json --detail --json

MCP read after topolo_validate_action and topolo_plan_action on the same input:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_auth.me.get",
    "input": {
      "appId": "app_topolo_docs"
    }
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "User info retrieved successfully",
  "data": {
    "user": {
      "id": "usr_profile_fixture",
      "email": "profile@example.test",
      "name": "Fixture human",
      "profilePicture": null,
      "orgId": "org_profile_fixture",
      "orgSlug": "profile-fixture",
      "householdId": null,
      "householdSlug": null,
      "selectedHouseholdId": null,
      "selectedHousehold": null,
      "role": "member",
      "permissions": [
        "app_topolo_docs.docs:read"
      ],
      "principalType": "human",
      "principalServices": [],
      "launcherEligible": true,
      "releaseCapabilities": {
        "enabled": [],
        "flagsAvailable": true
      },
      "activeContextType": "organization",
      "activeContextId": "org_profile_fixture",
      "activeContext": {
        "id": "org_profile_fixture",
        "name": "Fixture organization",
        "slug": "profile-fixture",
        "role": "member"
      },
      "availableContexts": [
        {
          "type": "organization",
          "id": "org_profile_fixture",
          "name": "Fixture organization",
          "slug": "profile-fixture",
          "role": "member"
        }
      ],
      "organizationMemberships": [
        {
          "id": "org_profile_fixture",
          "name": "Fixture organization",
          "slug": "profile-fixture",
          "role": "member"
        }
      ],
      "householdMemberships": [],
      "membershipSummary": {
        "organizations": [
          {
            "id": "org_profile_fixture",
            "name": "Fixture organization",
            "slug": "profile-fixture",
            "role": "member"
          }
        ],
        "households": []
      },
      "workspaceResourceAccess": {
        "enabled": false,
        "selectorVisible": false,
        "reason": "not-workspace-resource",
        "resources": [],
        "accessMode": "restricted",
        "canManageAll": false
      },
      "personalRecoveryEmail": {
        "id": "uem_profile_fixture",
        "userId": "usr_profile_fixture",
        "email": "recovery@example.test",
        "kind": "personal_recovery",
        "organizationId": null,
        "verifiedAt": 3,
        "verificationExpiresAt": null,
        "loginEnabled": false,
        "recoveryEnabled": true,
        "createdAt": 1,
        "updatedAt": 3
      },
      "recoveryEmailRequired": false,
      "passwordConfigured": true,
      "status": "active",
      "createdAt": 1,
      "lastLoginAt": 2,
      "organization": {
        "id": "org_profile_fixture",
        "name": "Fixture organization",
        "slug": "profile-fixture",
        "settings": {
          "appEntitlement": {
            "mode": "count",
            "paidAppCount": 2,
            "appSlugs": [
              "docs"
            ]
          }
        },
        "appEntitlement": {
          "mode": "count",
          "paidAppCount": 2,
          "appSlugs": [
            "docs"
          ]
        },
        "onboardingCompletedAt": 100
      }
    }
  },
  "timestamp": "2026-10-03T00:00:00.000Z"
}

Declared workspace policy is distinct from discovering a concrete workspace

Input · payload.json:

{
  "appId": "app_topolo_docs"
}

CLI:

topolo actions validate app_topolo_auth.me.get --data @payload.json --json
topolo actions plan app_topolo_auth.me.get --data @payload.json --json
topolo actions call app_topolo_auth.me.get --data @payload.json --detail --json

MCP read after topolo_validate_action and topolo_plan_action on the same input:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_auth.me.get",
    "input": {
      "appId": "app_topolo_docs"
    }
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "User info retrieved successfully",
  "data": {
    "user": {
      "id": "usr_profile_fixture",
      "email": "profile@example.test",
      "name": "Fixture human",
      "profilePicture": null,
      "orgId": "org_profile_fixture",
      "orgSlug": "profile-fixture",
      "householdId": null,
      "householdSlug": null,
      "selectedHouseholdId": null,
      "selectedHousehold": null,
      "role": "member",
      "permissions": [
        "app_topolo_docs.docs:read"
      ],
      "principalType": "human",
      "principalServices": [],
      "launcherEligible": true,
      "releaseCapabilities": {
        "enabled": [],
        "flagsAvailable": true
      },
      "activeContextType": "organization",
      "activeContextId": "org_profile_fixture",
      "activeContext": {
        "id": "org_profile_fixture",
        "name": "Fixture organization",
        "slug": "profile-fixture",
        "role": "member"
      },
      "availableContexts": [
        {
          "type": "organization",
          "id": "org_profile_fixture",
          "name": "Fixture organization",
          "slug": "profile-fixture",
          "role": "member"
        }
      ],
      "organizationMemberships": [
        {
          "id": "org_profile_fixture",
          "name": "Fixture organization",
          "slug": "profile-fixture",
          "role": "member"
        }
      ],
      "householdMemberships": [],
      "membershipSummary": {
        "organizations": [
          {
            "id": "org_profile_fixture",
            "name": "Fixture organization",
            "slug": "profile-fixture",
            "role": "member"
          }
        ],
        "households": []
      },
      "workspaceResourceAccess": {
        "enabled": false,
        "selectorVisible": false,
        "reason": "enterprise-required",
        "resourceType": "workspace",
        "resourceLabel": "Workspaces",
        "resources": [
          {
            "resourceType": "workspace",
            "resourceLabel": "Workspaces",
            "enabled": false,
            "reason": "enterprise-required"
          }
        ],
        "accessMode": "restricted",
        "canManageAll": false
      },
      "personalRecoveryEmail": {
        "id": "uem_profile_fixture",
        "userId": "usr_profile_fixture",
        "email": "recovery@example.test",
        "kind": "personal_recovery",
        "organizationId": null,
        "verifiedAt": 3,
        "verificationExpiresAt": null,
        "loginEnabled": false,
        "recoveryEnabled": true,
        "createdAt": 1,
        "updatedAt": 3
      },
      "recoveryEmailRequired": false,
      "passwordConfigured": true,
      "status": "active",
      "createdAt": 1,
      "lastLoginAt": 2,
      "organization": {
        "id": "org_profile_fixture",
        "name": "Fixture organization",
        "slug": "profile-fixture",
        "settings": {
          "appEntitlement": {
            "mode": "count",
            "paidAppCount": 2,
            "appSlugs": [
              "docs"
            ]
          }
        },
        "appEntitlement": {
          "mode": "count",
          "paidAppCount": 2,
          "appSlugs": [
            "docs"
          ]
        },
        "onboardingCompletedAt": 100
      }
    }
  },
  "timestamp": "2026-10-03T00:00:00.000Z"
}

Pinned OAuth retains its organization despite a different stored browser preference

Input · payload.json:

{
  "appId": "app_topolo_docs"
}

CLI:

topolo actions validate app_topolo_auth.me.get --data @payload.json --json
topolo actions plan app_topolo_auth.me.get --data @payload.json --json
topolo actions call app_topolo_auth.me.get --data @payload.json --detail --json

MCP read after topolo_validate_action and topolo_plan_action on the same input:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_auth.me.get",
    "input": {
      "appId": "app_topolo_docs"
    }
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "User info retrieved successfully",
  "data": {
    "user": {
      "id": "usr_profile_fixture",
      "email": "profile@example.test",
      "name": "Fixture human",
      "profilePicture": null,
      "orgId": "org_profile_fixture",
      "orgSlug": "profile-fixture",
      "householdId": null,
      "householdSlug": null,
      "selectedHouseholdId": null,
      "selectedHousehold": null,
      "role": "member",
      "permissions": [
        "app_topolo_docs.docs:read"
      ],
      "principalType": "human",
      "principalServices": [],
      "launcherEligible": true,
      "releaseCapabilities": {
        "enabled": [],
        "flagsAvailable": true
      },
      "activeContextType": "organization",
      "activeContextId": "org_profile_fixture",
      "activeContext": {
        "id": "org_profile_fixture",
        "name": "Fixture organization",
        "slug": "profile-fixture",
        "role": "member"
      },
      "availableContexts": [
        {
          "type": "organization",
          "id": "org_profile_fixture",
          "name": "Fixture organization",
          "slug": "profile-fixture",
          "role": "member"
        }
      ],
      "organizationMemberships": [
        {
          "id": "org_profile_fixture",
          "name": "Fixture organization",
          "slug": "profile-fixture",
          "role": "member"
        }
      ],
      "householdMemberships": [],
      "membershipSummary": {
        "organizations": [
          {
            "id": "org_profile_fixture",
            "name": "Fixture organization",
            "slug": "profile-fixture",
            "role": "member"
          }
        ],
        "households": []
      },
      "workspaceResourceAccess": {
        "enabled": false,
        "selectorVisible": false,
        "reason": "not-workspace-resource",
        "resources": [],
        "accessMode": "restricted",
        "canManageAll": false
      },
      "personalRecoveryEmail": {
        "id": "uem_profile_fixture",
        "userId": "usr_profile_fixture",
        "email": "recovery@example.test",
        "kind": "personal_recovery",
        "organizationId": null,
        "verifiedAt": 3,
        "verificationExpiresAt": null,
        "loginEnabled": false,
        "recoveryEnabled": true,
        "createdAt": 1,
        "updatedAt": 3
      },
      "recoveryEmailRequired": false,
      "passwordConfigured": true,
      "status": "active",
      "createdAt": 1,
      "lastLoginAt": 2,
      "organization": {
        "id": "org_profile_fixture",
        "name": "Fixture organization",
        "slug": "profile-fixture",
        "settings": {
          "appEntitlement": {
            "mode": "count",
            "paidAppCount": 2,
            "appSlugs": [
              "docs"
            ]
          }
        },
        "appEntitlement": {
          "mode": "count",
          "paidAppCount": 2,
          "appSlugs": [
            "docs"
          ]
        },
        "onboardingCompletedAt": 100
      }
    }
  },
  "timestamp": "2026-10-03T00:00:00.000Z"
}

Input · payload.json:

{
  "appId": "app_topolo_docs"
}

CLI:

topolo actions validate app_topolo_auth.me.get --data @payload.json --json
topolo actions plan app_topolo_auth.me.get --data @payload.json --json
topolo actions call app_topolo_auth.me.get --data @payload.json --detail --json

MCP read after topolo_validate_action and topolo_plan_action on the same input:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_auth.me.get",
    "input": {
      "appId": "app_topolo_docs"
    }
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "User info retrieved successfully",
  "data": {
    "user": {
      "id": "usr_profile_fixture",
      "email": "profile@example.test",
      "name": "Fixture human",
      "profilePicture": null,
      "orgId": "org_profile_fixture",
      "orgSlug": "profile-fixture",
      "householdId": null,
      "householdSlug": null,
      "selectedHouseholdId": null,
      "selectedHousehold": null,
      "role": "service",
      "permissions": [
        "profile",
        "app_topolo_docs.docs:read"
      ],
      "principalType": "human",
      "principalServices": [],
      "launcherEligible": true,
      "releaseCapabilities": {
        "enabled": [],
        "flagsAvailable": true
      },
      "activeContextType": "organization",
      "activeContextId": "org_profile_fixture",
      "activeContext": {
        "id": "org_profile_fixture",
        "name": "Fixture organization",
        "slug": "profile-fixture",
        "role": "member"
      },
      "availableContexts": [
        {
          "type": "organization",
          "id": "org_profile_fixture",
          "name": "Fixture organization",
          "slug": "profile-fixture",
          "role": "member"
        }
      ],
      "organizationMemberships": [
        {
          "id": "org_profile_fixture",
          "name": "Fixture organization",
          "slug": "profile-fixture",
          "role": "member"
        }
      ],
      "householdMemberships": [],
      "membershipSummary": {
        "organizations": [
          {
            "id": "org_profile_fixture",
            "name": "Fixture organization",
            "slug": "profile-fixture",
            "role": "member"
          }
        ],
        "households": []
      },
      "workspaceResourceAccess": {
        "enabled": false,
        "selectorVisible": false,
        "reason": "not-workspace-resource",
        "resources": [],
        "accessMode": "restricted",
        "canManageAll": false
      },
      "personalRecoveryEmail": {
        "id": "uem_profile_fixture",
        "userId": "usr_profile_fixture",
        "email": "recovery@example.test",
        "kind": "personal_recovery",
        "organizationId": null,
        "verifiedAt": 3,
        "verificationExpiresAt": null,
        "loginEnabled": false,
        "recoveryEnabled": true,
        "createdAt": 1,
        "updatedAt": 3
      },
      "recoveryEmailRequired": false,
      "passwordConfigured": true,
      "status": "active",
      "createdAt": 1,
      "lastLoginAt": 2,
      "organization": {
        "id": "org_profile_fixture",
        "name": "Fixture organization",
        "slug": "profile-fixture",
        "settings": {
          "appEntitlement": {
            "mode": "count",
            "paidAppCount": 2,
            "appSlugs": [
              "docs"
            ]
          }
        },
        "appEntitlement": {
          "mode": "count",
          "paidAppCount": 2,
          "appSlugs": [
            "docs"
          ]
        },
        "onboardingCompletedAt": 100
      }
    }
  },
  "timestamp": "2026-10-03T00:00:00.000Z"
}

Dark personal capability yields no released active context

Input · payload.json:

{}

CLI:

topolo actions validate app_topolo_auth.me.get --data @payload.json --json
topolo actions plan app_topolo_auth.me.get --data @payload.json --json
topolo actions call app_topolo_auth.me.get --data @payload.json --detail --json

MCP read after topolo_validate_action and topolo_plan_action on the same input:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_auth.me.get",
    "input": {}
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "User info retrieved successfully",
  "data": {
    "user": {
      "id": "usr_profile_fixture",
      "email": "profile@example.test",
      "name": "Fixture human",
      "profilePicture": null,
      "orgId": null,
      "orgSlug": null,
      "householdId": null,
      "householdSlug": null,
      "selectedHouseholdId": null,
      "selectedHousehold": null,
      "role": "member",
      "permissions": [],
      "principalType": "human",
      "principalServices": [],
      "launcherEligible": true,
      "releaseCapabilities": {
        "enabled": [],
        "flagsAvailable": true
      },
      "activeContextType": null,
      "activeContextId": null,
      "activeContext": null,
      "availableContexts": [],
      "organizationMemberships": [],
      "householdMemberships": [],
      "membershipSummary": {
        "organizations": [],
        "households": []
      },
      "workspaceResourceAccess": null,
      "personalRecoveryEmail": {
        "id": "uem_profile_fixture",
        "userId": "usr_profile_fixture",
        "email": "recovery@example.test",
        "kind": "personal_recovery",
        "organizationId": null,
        "verifiedAt": 3,
        "verificationExpiresAt": null,
        "loginEnabled": false,
        "recoveryEnabled": true,
        "createdAt": 1,
        "updatedAt": 3
      },
      "recoveryEmailRequired": false,
      "passwordConfigured": true,
      "status": "active",
      "createdAt": 1,
      "lastLoginAt": 2,
      "organization": null
    }
  },
  "timestamp": "2026-10-03T00:00:00.000Z"
}

Organization lookup failure still returns a reduced organization projection

Input · payload.json:

{
  "appId": "app_topolo_docs"
}

CLI:

topolo actions validate app_topolo_auth.me.get --data @payload.json --json
topolo actions plan app_topolo_auth.me.get --data @payload.json --json
topolo actions call app_topolo_auth.me.get --data @payload.json --detail --json

MCP read after topolo_validate_action and topolo_plan_action on the same input:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_auth.me.get",
    "input": {
      "appId": "app_topolo_docs"
    }
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "User info retrieved successfully",
  "data": {
    "user": {
      "id": "usr_profile_fixture",
      "email": "profile@example.test",
      "name": "Fixture human",
      "profilePicture": null,
      "orgId": "org_profile_fixture",
      "orgSlug": "profile-fixture",
      "householdId": null,
      "householdSlug": null,
      "selectedHouseholdId": null,
      "selectedHousehold": null,
      "role": "member",
      "permissions": [
        "app_topolo_docs.docs:read"
      ],
      "principalType": "human",
      "principalServices": [],
      "launcherEligible": true,
      "releaseCapabilities": {
        "enabled": [],
        "flagsAvailable": true
      },
      "activeContextType": "organization",
      "activeContextId": "org_profile_fixture",
      "activeContext": {
        "id": "org_profile_fixture",
        "name": "Fixture organization",
        "slug": "profile-fixture",
        "role": "member"
      },
      "availableContexts": [
        {
          "type": "organization",
          "id": "org_profile_fixture",
          "name": "Fixture organization",
          "slug": "profile-fixture",
          "role": "member"
        }
      ],
      "organizationMemberships": [
        {
          "id": "org_profile_fixture",
          "name": "Fixture organization",
          "slug": "profile-fixture",
          "role": "member"
        }
      ],
      "householdMemberships": [],
      "membershipSummary": {
        "organizations": [
          {
            "id": "org_profile_fixture",
            "name": "Fixture organization",
            "slug": "profile-fixture",
            "role": "member"
          }
        ],
        "households": []
      },
      "workspaceResourceAccess": {
        "enabled": false,
        "selectorVisible": false,
        "reason": "not-workspace-resource",
        "resources": [],
        "accessMode": "restricted",
        "canManageAll": false
      },
      "personalRecoveryEmail": {
        "id": "uem_profile_fixture",
        "userId": "usr_profile_fixture",
        "email": "recovery@example.test",
        "kind": "personal_recovery",
        "organizationId": null,
        "verifiedAt": 3,
        "verificationExpiresAt": null,
        "loginEnabled": false,
        "recoveryEnabled": true,
        "createdAt": 1,
        "updatedAt": 3
      },
      "recoveryEmailRequired": false,
      "passwordConfigured": true,
      "status": "active",
      "createdAt": 1,
      "lastLoginAt": 2,
      "organization": {
        "id": "org_profile_fixture",
        "name": "profile-fixture",
        "slug": "profile-fixture",
        "settings": {},
        "appEntitlement": null,
        "onboardingCompletedAt": 100
      }
    }
  },
  "timestamp": "2026-10-03T00:00:00.000Z"
}

Verified platform authority bypasses denied ordinary application membership

Input · payload.json:

{
  "appId": "app_topolo_docs"
}

CLI:

topolo actions validate app_topolo_auth.me.get --data @payload.json --json
topolo actions plan app_topolo_auth.me.get --data @payload.json --json
topolo actions call app_topolo_auth.me.get --data @payload.json --detail --json

MCP read after topolo_validate_action and topolo_plan_action on the same input:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_auth.me.get",
    "input": {
      "appId": "app_topolo_docs"
    }
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "User info retrieved successfully",
  "data": {
    "user": {
      "id": "usr_profile_fixture",
      "email": "profile@example.test",
      "name": "Fixture human",
      "profilePicture": null,
      "orgId": "org_profile_fixture",
      "orgSlug": "profile-fixture",
      "householdId": null,
      "householdSlug": null,
      "selectedHouseholdId": null,
      "selectedHousehold": null,
      "role": "member",
      "permissions": [
        "app_topolo_docs.docs:read"
      ],
      "principalType": "human",
      "principalServices": [],
      "launcherEligible": true,
      "releaseCapabilities": {
        "enabled": [],
        "flagsAvailable": true
      },
      "activeContextType": "organization",
      "activeContextId": "org_profile_fixture",
      "activeContext": {
        "id": "org_profile_fixture",
        "name": "Fixture organization",
        "slug": "profile-fixture",
        "role": "member"
      },
      "availableContexts": [
        {
          "type": "organization",
          "id": "org_profile_fixture",
          "name": "Fixture organization",
          "slug": "profile-fixture",
          "role": "member"
        }
      ],
      "organizationMemberships": [
        {
          "id": "org_profile_fixture",
          "name": "Fixture organization",
          "slug": "profile-fixture",
          "role": "member"
        }
      ],
      "householdMemberships": [],
      "membershipSummary": {
        "organizations": [
          {
            "id": "org_profile_fixture",
            "name": "Fixture organization",
            "slug": "profile-fixture",
            "role": "member"
          }
        ],
        "households": []
      },
      "workspaceResourceAccess": {
        "enabled": false,
        "selectorVisible": false,
        "reason": "not-workspace-resource",
        "resources": [],
        "accessMode": "all",
        "canManageAll": true
      },
      "personalRecoveryEmail": {
        "id": "uem_profile_fixture",
        "userId": "usr_profile_fixture",
        "email": "recovery@example.test",
        "kind": "personal_recovery",
        "organizationId": null,
        "verifiedAt": 3,
        "verificationExpiresAt": null,
        "loginEnabled": false,
        "recoveryEnabled": true,
        "createdAt": 1,
        "updatedAt": 3
      },
      "recoveryEmailRequired": false,
      "passwordConfigured": true,
      "status": "active",
      "createdAt": 1,
      "lastLoginAt": 2,
      "organization": {
        "id": "org_profile_fixture",
        "name": "Fixture organization",
        "slug": "profile-fixture",
        "settings": {
          "appEntitlement": {
            "mode": "count",
            "paidAppCount": 2,
            "appSlugs": [
              "docs"
            ]
          }
        },
        "appEntitlement": {
          "mode": "count",
          "paidAppCount": 2,
          "appSlugs": [
            "docs"
          ]
        },
        "onboardingCompletedAt": 100
      }
    }
  },
  "timestamp": "2026-10-03T00:00:00.000Z"
}

Verify the result

Match data.user.id to the same pinned authenticated principal; match the returned orgId and released active context to that credential’s discovered context.
For appId, inspect permissions and workspaceResourceAccess, then discover the intended target action and authorized resources separately; do not infer a mutation grant from this profile.

Errors and recovery

Application profile refuses an absent released context

Input:

{
  "appId": "app_topolo_docs"
}

Captured local refusal · HTTP 403:

{
  "success": false,
  "error": {
    "message": "User does not have access to this service",
    "code": "FORBIDDEN",
    "details": null,
    "timestamp": "2026-10-03T00:00:00.000Z"
  }
}

Application access is refused before permissions are returned

Input:

{
  "appId": "app_topolo_docs"
}

Captured local refusal · HTTP 403:

{
  "success": false,
  "error": {
    "message": "User does not have access to this service",
    "code": "FORBIDDEN",
    "details": null,
    "timestamp": "2026-10-03T00:00:00.000Z"
  }
}

Missing credential is refused

Input:

{}

Captured local refusal · HTTP 401:

{
  "success": false,
  "error": {
    "message": "Access token required",
    "code": "AUTH_ERROR",
    "details": null,
    "timestamp": "2026-10-03T00:00:00.000Z"
  }
}

Invalid credential is refused

Input:

{}

Captured local refusal · HTTP 401:

{
  "success": false,
  "error": {
    "message": "Synthetic invalid credential",
    "code": "AUTH_ERROR",
    "details": null,
    "timestamp": "2026-10-03T00:00:00.000Z"
  }
}

Deleted or absent authenticated user is not found

Input:

{}

Captured local refusal · HTTP 404:

{
  "success": false,
  "error": {
    "message": "User not found",
    "code": "NOT_FOUND",
    "details": null,
    "timestamp": "2026-10-03T00:00:00.000Z"
  }
}

Supporting storage failure currently maps to an authentication error

Input:

{}

Captured local refusal · HTTP 401:

{
  "success": false,
  "error": {
    "message": "Synthetic recovery storage unavailable",
    "code": "AUTH_ERROR",
    "details": null,
    "timestamp": "2026-10-03T00:00:00.000Z"
  }
}

Published recovery guidance

AUTH_ERROR (HTTP 401): Verify current credential identity and exact error. Missing/invalid tokens and caught supporting-store failures share this code; preserve request id before treating it as expiry.
FORBIDDEN (HTTP 403): Stop the selected application read and report the missing released context or denied application membership; do not widen context or substitute an endpoint.
NOT_FOUND (HTTP 404): The authenticated stored user is missing. Preserve the principal/request evidence and obtain account support; this read does not provision a user.

Recovery boundary

This read has no rollback. Recheck the pinned identity after a credential failure; use the published login flow only when authentication expiry is established. For HTTP 403 keep the same context and report denied application access. For reduced organization data or supporting-store 401 retain sanitized evidence and request id for an authorized maintainer; do not infer a different context, endpoint or absent onboarding.

Discovery and evidence

Actual isolated Auth profile handler responses; no live identity, credential, application or organization changed.

Real: Auth profile handler; OAuth context binding and release projection; Principal context and workspace access projection; Response serialization. Simulated: Verified tokens; Hydrated user and organization repository; Permission and membership reads; Recovery email/service reads; Flags, clock and fault injection. No live OAuth, identity, organization, user profile or recovery address changed.

Get my Auth profile

Outcome

Before you start

Discover the identity and application

Input fields

Response fields

Interpret the response

Worked examples

Read the current human profile without an application selector

Browser cookie profile includes permissions for the discovered application

Declared workspace policy is distinct from discovering a concrete workspace

Pinned OAuth retains its organization despite a different stored browser preference

Third-party OAuth returns its string consent permissions

Dark personal capability yields no released active context

Organization lookup failure still returns a reduced organization projection

Verified platform authority bypasses denied ordinary application membership

Verify the result

Errors and recovery

Application profile refuses an absent released context

Application access is refused before permissions are returned

Missing credential is refused

Invalid credential is refused

Deleted or absent authenticated user is not found

Supporting storage failure currently maps to an authentication error

Published recovery guidance

Recovery boundary

Discovery and evidence