AuthUser

User information from unified auth system

activeEntityId
Type: stringFormat: uuid

Currently active tenant context (session) or the key's issuing tenant (entity-bound API key).
email
Type: stringFormat: email
entityIds
Type: array of stringFormat: uuid

Tenants this request may act in. For session auth, all tenants the user belongs to; for an entity-bound API key, exactly one entry — the key's issuing tenant.
firstName
Type: string
id
Type: stringFormat: uuid
lastName
Type: string
mfaEnabled
Type: boolean

Whether the user has 2FA enrolled
mfaVerified
Type: boolean

False on an otherwise-valid session means an SSO MFA re-challenge is pending — the session authenticates but non-MFA routes return 403 until TOTP/OTP clears it. Clients should route to the MFA step in that case.
primaryEntityId
Type: stringFormat: uuid

User's primary/default tenant for session auth; for an entity-bound API key, the key's issuing tenant.
twoFactorEnabled
Type: boolean