AuthCredential

The credential the request authenticated with. name and keyStart are present only for api_key, where each is null when the key row can no longer be read. Timestamps are null when the backing row can no longer be read.

entityId
Type: stringFormat: uuidnullable
required

For a session, the active tenant. For an API key, the tenant recorded on the key row; a key with no tenant of its own does not authenticate. Falls back to the pinned primary tenant only when the key row has been removed since authentication, so this always equals grants.entityId.
expiresAt
Type: stringFormat: date-timenullable
required

Null when the credential never expires
id
Type: string
required

The session id or API key id
impersonatedBy
Type: stringFormat: uuidnullable
required

The impersonating admin's user id when the session was opened by impersonation
issuedAt
Type: stringFormat: date-timenullable
required

the date-time notation as defined by RFC 3339, section 5.6, for example, 2017-07-21T17:32:28Z
kind
Type: "session" or "api_key"enum
required
lastUsedAt
Type: stringFormat: date-timenullable
required

Always null for a session — sessions carry no last-use tracking
keyStart
Type: stringnullable

The stored start of the key (configured prefix plus the leading characters), the same value the API-keys list shows as start; never the secret. API key only, and only ever returned to the holder of that key.
name
Type: stringnullable

API key only — the name the key was created with, or null when the key row can no longer be read.

AuthUser

AuthGrantRole