The caller's own tenant — never returns api_secret

GET

/operator/tenant

const url = 'http://localhost:3000/operator/tenant';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url http://localhost:3000/operator/tenant \
  --header 'Authorization: Bearer <token>'

Takes no tenant id in the path or query. The tenant comes from the operator row the guard loaded, which makes IDOR structurally impossible. Platform staff have no tenant to read this way — they use GET /admin/tenants/{id} instead.

Authorizations

operatorToken

Responses

200

The caller’s tenant.

application/json

object

required

string

name

required

string

api_key

required

string

status

required

string

Allowed values: active suspended

created_at

required

string format: date-time

Example

{
  "status": "active"
}

401

Invalid, expired, revoked, or absent token.

application/json

object

error

required

object

code

required

string

Allowed values: VALIDATION_FAILED UNAUTHENTICATED FORBIDDEN NOT_FOUND CONFLICT RATE_LIMITED INTERNAL

message

required

string

requestId

required

string

fields

Present only for VALIDATION_FAILED.

Array<object>

object

path

string

message

string

Example

{
  "error": {
    "code": "VALIDATION_FAILED"
  }
}

403

Caller is platform staff, who have no tenant to read — use GET /admin/tenants/{id} instead. Both owner and member may read.

application/json

object

error

required

object

code

required

string

Allowed values: VALIDATION_FAILED UNAUTHENTICATED FORBIDDEN NOT_FOUND CONFLICT RATE_LIMITED INTERNAL

message

required

string

requestId

required

string

fields

Present only for VALIDATION_FAILED.

Array<object>

object

path

string

message

string

Example

{
  "error": {
    "code": "VALIDATION_FAILED"
  }
}