Outcome
Read the authenticated user and organization objects used by Forms. Despite the action name, this response does not list or select a workspace.
GET /api/bootstrap
Before you start
Use the original authorized identity, intended environment and context. Discover the current action and its published workspace:read permission; input is exactly {}. This app bootstrap is not an access-control bypass or a way to select another organization.
Public documentation does not make the actual returned user/organization public. Keep real identity details within the approved caller workflow. The two examples below are complete source-derived synthetic responses, not captured Auth or tenant data.
No actual Forms/bootstrap/Auth introspection, user lookup, business/subject read, credential extraction, provider/model or notification action was executed. Source declaration provenance matches the reviewed revision, but loaded runtime and browser behavior remain independently unverified.
Request and response
Action: app_topolo_forms.workspace.bootstrap. Input:
{}
The selected GET /api/bootstrap path resolves the canonical application id and original authentication first, then returns {user:auth.user,organization:auth.organization}. The authenticated objects are forwarded from the verified result, not constructed into a workspace model. Fields vary with the actual Auth result; illustrative user fields are not an exhaustive future identity schema.
In this worker, bootstrap returns before the later organization_required check and before required workspace resolution. An authenticated result without an organization can therefore have no organization value; this does not grant a personal workspace, bypass the published action/runtime permission or authorize another route.
There is no workspace, workspace list, default flag, form id, grant decision or credential in the concrete carrier constructed by this handler. Do not follow generic workspace-record/id metadata as though those fields were present. Discover canonical Forms resources and workspace policy through supported Auth workspace/resource actions.
The underlying auth result can include API-key authorization state internally, but this path explicitly selects only user and organization for JSON. It does not return the key/token, mint a credential, switch context, create a workspace or refresh a session as a business effect. Authentication/introspection activity remains part of the normal protected read.
App identity failures and original Auth failures occur before this return. Do not interpret an identity/dependency/permission refusal as an empty workspace. Preserve the actual request id and sanitized carrier; this guide does not invent a full shared middleware failure schema.
Complete worked responses
Authenticated context objects
Complete source-derived synthetic, unrun HTTP200. Assumes the original runtime/action authorization succeeds and the verified Auth result contains exactly the fictional user and organization objects shown. This is not a live identity read or an exhaustive Auth model.
Response:
{
"user": {
"id": "usr_docs_fixture",
"email": "reader@example.test"
},
"organization": {
"id": "org_docs_fixture",
"name": "Fixture organization"
}
}
Compare actual identity and organization with the intended original context, then use supported Auth discovery for workspace ids and eligibility; this carrier contains no workspace.
API-key service configuration unavailable
Complete source-derived synthetic, unrun HTTP401 for the selected verifyFormsRequest branch when an API-key request reaches it and the service client configuration is absent. This example does not claim the running production service has this fault; no binding, credential or configuration was inspected or changed.
Response:
{
"error": "API key auth is not configured for this service"
}
Preserve actual status/request evidence for the application owner. Do not replace the original credential/context or broaden permissions to evade the refusal.
Verify and continue
-
Compare the actual user and organization with the original intended caller context. The handler forwards these objects; it does not prove a workspace grant merely because a user or organization is present.
-
For workspace work, use supported Auth resource/workspace discovery and its caller-specific policy. Bind the discovered resource separately for the next action, then validate and plan that action as applicable. Do not infer a workspace from a user/org id or absence of an organization.
-
Keep actual identity fields private and retain sanitized request evidence on failure. Do not run a form mutation, submission, export, key provisioning or context switch as a bootstrap verification step.
This read needs no data rollback. A failure must not be converted into a workspace creation or broader access change.
Refusals
503 / app_identity_unavailable: The selected app-id wrapper returns this code with its actual sanitized message. Refer canonical identity/configuration failure to the owning service; action input cannot provision it.
401 / API key auth is not configured for this service: Selected API-key verifier branch; preserve actual evidence for the app owner. No missing production configuration is asserted.
401 / API key validation failed: Original API-key introspection did not succeed. Reconcile the original credential and resource policy through supported Auth, without an alternate-context bypass.
503 / Auth service unavailable: Selected API-key verifier catches service/introspection failures with this carrier. Preserve actual request evidence; it is not a unique diagnosis or automatic replay authorization.
Actual shared runtime/auth carriers can differ. The generic structural success schema is not proof that an error body is a successful context read.
Change log
- 2026-10-21: Documented the actual user/organization carrier, pre-workspace return point, original authentication and privacy boundaries, and complete illustrative success/refusal responses. No live identity or workspace operation was performed.