Auth status

GET /v1/auth/status

Read redacted auth profiles and Minara session and connection state.

Response body

{
  "minara_connected": true,
  "minara_oauth_connected": true,
  "minara_source": "oauth-profile",
  "minara_session": {
    "state": "present",
    "connection": "ready"
  },
  "minara_account_scope": "opaque-account-scope",
  "minara_credential_revision": "opaque-credential-revision"
}

Notes

The example shows the Minara fields only; the response also includes provider configuration and redacted profiles. minara_session.state is absent, present, reauth_required, or unknown; connection is independently ready, refreshing, or unavailable. present preserves local authorization context while the server may be unreachable. unknown covers temporarily unreadable credentials. An optional reason explains an explicit rejection or key-store problem. Do not start login merely because the connection is unavailable. Treat minara_account_scope as an opaque cache partition: clear account-bound cached data when it changes. It may be absent while credentials are unreadable; that absence alone does not establish logout. minara_credential_revision changes independently of account identity when credentials rotate. On a changed known revision, allow paused reads to retry against the server and retain cached data if the account scope is unchanged. A repeated or missing revision does not release paused reads. An updated revision is not proof of elevated permission; the server may challenge again. Never automatically replay failed writes. Do not parse it or use it as authentication. The legacy connection booleans remain available; minara_oauth_connected specifically requires an OAuth identity, so an API key cannot unlock the web application.