session

Who the server thinks the caller is

Who the server thinks the caller is: audience, shop and roles, read from the verified token. Use it after login or a token refresh.

POST/graphqlapp audience

POST/platform/graphqladmin audience

POST/console/graphqlconsole audience

Who can call this. Any signed-in caller of the endpoint's audience. You can run it against Local or Staging from the request panel, with a demo-shop token.

Headers

Required Optional

AuthorizationstringRequired
Bearer <token>, issued for this endpoint's audience. The token decides the shop and roles; nothing in the request body can change them.
Example: Bearer eyJhbGciOiJFZERTQSJ9…
Content-TypestringRequired
Always application/json. Only POST is accepted.
Example: application/json
X-Request-IdstringOptional
Your id for this request (8–128 characters of A–Z a–z 0–9 . _ : -). Echoed back in the response header and in every error, so you can quote it when reporting a problem. Core makes one if you send none.
Example: app-7f3c2a9e-checkout

Arguments

This operation takes no arguments.

Returns

Required Optional

sessionSession!Required
Who the server thinks the caller is: audience, shop and roles, read from the verified token. Use it after login or a token refresh.
Show children
- audienceAudience!Required
  The client the token was issued to.
  Example: "app"
  - adminThe N1 administration portal (N1 staff). Endpoint /platform/graphql.
  - appThe N1 shop app (owners, accountants, supervisors, operators, QC). Endpoint /graphql.
  - consoleTurret, the N1 operations console (N1 staff). Endpoint /console/graphql.
- roles[String!]!Required
  The caller's roles in this shop (for example owner, supervisor), or their N1 staff roles.
  Example: ["owner"]
- tenantIdIDOptional
  The shop the caller acts in. Always set for app; always null for N1 staff.
  Example: "0192f0c1-0000-7000-8000-00000000000a"
- userIdIDOptional
  The signed-in user.
  Example: "0192f0c1-0000-7000-8000-0000000000a1"

Errors

Code	HTTP	When
`UNAUTHENTICATED`	`401`	No session, or the token is missing, expired or invalid.
`RATE_LIMITED`	`429`	The caller went over a rate limit.

Every error has the same body. See Errors.

Rate limit tier

Tier: per user. Over the limit you get RATE_LIMITED (HTTP 429) with a Retry-After header. See Response handling.