Who is calling
const url = 'http://localhost:3000/api/v1/me';const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url http://localhost:3000/api/v1/me \ --header 'Authorization: Bearer <token>'The person or key, the project this request acts in (a key’s own; for a person, the one in the ab_project cookie if they can open it), the scope there and on its organization, every project they can switch to, and how one signs in here.
Any caller; the scope needed is checked on what it acts on.
Authorizations
Section titled “Authorizations”Responses
Section titled “Responses”You
object
object
Calling with an API key
How history names you
Where this request acts: a key’s project, or the one picked in the app
object
object
The organization is read-only: whatever the grants say, the scope is read at most
No scope on the project, but grants on some collections or assets in it
The organization can send email now: invitations and links go out by mail
Grants on single collections, assets and brands here, by id: what reaches past the project scope
object
object
object
object
The project’s private collections and brands: only a grant on one, or admin, reaches it
Every project you can switch to
object
object
Features turned off in this project, by its organization or itself (GET /api/v1/features): agents, shares, portals, hub, insights, and the server’s own
Where a brand gets kept in a Git repository (GIT_CONNECT_URL), {brand} standing for its slug, empty to bring a new brand in: set for a project admin, else null
This server runs BrandHub (HUB_URL)
object
Nobody has an account yet: the first one made is the admin of everything
Making that first account takes the server’s setup token (SETUP_TOKEN)
Anyone may make an account, and gets an organization of their own (SIGNUP=open)
Sign-in with Google is on (GOOGLE_*)
Some organization here signs its people in through its own provider: sign-in offers it by email domain
A forgotten password can be reset by email
The server sends every organization’s email (EMAIL_*): organizations don’t set their own, and a new account confirms its address with a code
The Cloudflare Turnstile site key (TURNSTILE_SITE_KEY) when captcha is turnstile, else null
Example
{ "data": { "scope": "read", "orgScope": "read", "narrow": { "collections": { "additionalProperty": "read" }, "assets": { "additionalProperty": "read" }, "brands": { "additionalProperty": "read" } }, "features": [ "agents" ], "auth": { "anonymous": "read", "captcha": "turnstile" } }}default
Section titled “default”An error
object
object
Examplegenerated
{ "error": { "code": "example", "message": "example", "detail": "example" }}