> ## Documentation Index > Fetch the complete documentation index at: https://api-docs.helpyousponsor.com/llms.txt > Use this file to discover all available pages before exploring further. # Get the currently authenticated admin user > Returns the authenticated admin user along with current permissions, feature entitlements and the server-derived access manifest. Used by the admin web app on app boot / route guard checks. Requires authentication via Passport bearer token or API key. Returns 401 if unauthenticated and 403 when onboarding, workspace, membership or access-role eligibility blocks access. ## OpenAPI ````yaml get /user openapi: 3.0.0 info: title: Gratona API description: >- REST API for the Gratona fundraising platform, including donor, donation, sponsorship, program, event, and integration workflows. Endpoints are organized by tag. Most endpoints require either a Passport bearer token or an issued API key — see the Security Schemes section. contact: name: Gratona Engineering url: https://gratona.com email: devs@gratona.com version: 1.0.0 servers: - url: https://api.gratona.com/v1 description: Server Version 1.0.0 security: [] tags: - name: Auth description: >- Login, signup, logout, password reset, and email verification for admin users and donors. - name: Donors description: >- Donor records: CRUD, profile fields, household linkage, search, filters, merge, and duplicate detection. - name: Donations description: >- Individual donation records, recurring commitments, soft credits, refunds, designations, and exports. - name: Sponsorships description: >- Donor-to-entity sponsorship relationships, lifecycle transitions, and sponsorship-specific filters. - name: Entities description: >- Recipient records (children, families, projects, animals, etc.), their status, and entity-level fields. - name: Programs description: >- Program / campaign configuration: hierarchy, settings, and program-level metadata. - name: Forms description: >- Custom form builder (HysForm), form fields, standardized donor fields, and field migrations. - name: Trips description: >- Mission-trip management: trips, participants, budgets, tasks, e-signatures, fundraising milestones, and background checks. - name: Communications description: >- Email templates, SMS, newsletters, donor email manager, and per-donor notes. - name: Payments description: >- Payment-gateway management (Stripe, PayPal, Flutterwave, QuickBooks). Excludes inbound webhooks — see the Webhooks tag. - name: Reports description: Dashboards, analytics, scheduled reports, and exports. - name: Admin description: >- Client-account administration: users, groups/permissions, settings, integrations, and account lifecycle. - name: Donor Portal description: >- Endpoints consumed by the donor-facing portal (donor login, dashboard, donation history, messages). - name: Recipient Portal description: Endpoints consumed by the recipient-facing portal. - name: Public description: >- Unauthenticated public endpoints: donor signup, public trip pages, peer-to-peer campaigns, public checkout. - name: Webhooks description: >- Inbound webhooks from third parties (Stripe, PayPal, Flutterwave, Checkr, DropboxSign). Annotated minimally for reference; payload shapes are owned by the upstream provider. - name: Client description: Client - name: Email Settings description: Email Settings - name: Admin Dashboard description: Admin Dashboard - name: Historical Archived Updates description: Historical Archived Updates - name: Team & access description: Team & access - name: Files description: Files - name: Wrapped description: Wrapped - name: Donor SignUp description: Donor SignUp - name: Frontend description: Frontend - name: User description: User paths: /user: get: tags: - Auth summary: Get the currently authenticated admin user description: >- Returns the authenticated admin user along with current permissions, feature entitlements and the server-derived access manifest. Used by the admin web app on app boot / route guard checks. Requires authentication via Passport bearer token or API key. Returns 401 if unauthenticated and 403 when onboarding, workspace, membership or access-role eligibility blocks access. operationId: b006bd8660db20d265f2959763e15564 responses: '200': description: Authenticated user + group permissions. content: application/json: schema: properties: status: type: string example: success user: $ref: '#/components/schemas/User' entitlements: description: >- Resolved organization feature entitlements with live AI quota usage where available. Null when resolution fails. properties: version: type: integer example: 1 enforcement: type: string example: log catalog: type: string example: gratona_public_2026 nullable: true tier: type: string example: growth nullable: true tier_name: type: string example: Growth nullable: true quota_period: type: string enum: - one_time - billing_cycle example: billing_cycle degraded: type: boolean example: false features: description: >- Feature-key map. Entries include type, name, enabled, source and locked; quota, allowance, trial and tier metadata depend on the feature. type: object additionalProperties: type: object type: object nullable: true access_manifest: description: >- Server-derived access role and effective authority for the authenticated staff member. properties: version: type: integer example: 1 role: properties: id: type: integer example: 7 name: type: string example: Fundraising team is_full_access: type: boolean example: false version: type: integer example: 3 type: object nullable: true effective_access: description: >- Permission-key map containing allowed, source, area and level. type: object additionalProperties: type: object access_by_area: description: >- Area-key map containing id, area, allowed, level, source and reason. type: object additionalProperties: type: object restrictions: description: Active restrictions; absent when no role is resolved. type: array items: type: string example: disable_message_send_without_approval authority: type: array items: type: string example: donors_view can_manage: type: boolean example: false refresh_url: type: string example: /v1/admin/access/manifest type: object permissions: description: >- Decoded permissions map from the user's group. Empty object when the group has no permissions JSON. type: object additionalProperties: true type: object '401': description: No valid bearer token / API key supplied. content: application/json: schema: $ref: '#/components/schemas/UnauthorizedResponse' '403': description: >- Onboarding is incomplete, the workspace is missing or closed, the staff membership is inactive, or no access role is assigned. Incomplete onboarding also includes user_id and stage. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - bearerAuth: [] - apiKeyAuth: [] components: schemas: User: title: User description: >- An admin user — staff member of a client organization. Authenticates via Laravel Passport (bearer JWT) for the admin web app, and may also issue API keys (via `ApiKey`) for server-to-server integrations. Permissions are stored as JSON keyed by feature; group membership (`group_id`) supplies a baseline permission set on top of the per-user override. required: - id - email - client_id properties: id: description: Internal user ID. type: integer format: int64 example: 1024 email: description: >- User email — also the login identifier. Unique across the whole users table. type: string format: email example: staff@gratona.com first_name: description: Given name. type: string example: Alex nullable: true last_name: description: Family name. type: string example: Morgan nullable: true phone: description: Optional phone number for SMS / call notifications. type: string example: '+15551234567' nullable: true client_id: description: >- Client (tenant) the user belongs to. Stored as string for historical reasons; numeric in practice. type: string example: '207' group_id: description: >- Permission group the user belongs to; supplies baseline permissions before the per-user override. type: integer format: int64 example: 4 nullable: true permissions: description: >- Per-user permission overrides as a JSON map keyed by permission slug. Values are typically the string `1` (granted) or absent. Merged with group permissions at request time. Example: `{group_all: 1, donor-42: 1}`. type: object nullable: true additionalProperties: true onboarding_status: description: >- Onboarding-flow stage marker. `3` = onboarding complete; lower values indicate the user is still in setup. type: string example: '3' nullable: true activated: description: >- Whether the account is activated (email verified / activation code redeemed). type: boolean example: true access_disabled_at: description: >- Administrative disable timestamp. Authorized admin payloads expose it so clients can distinguish disabled access from a pending mailbox-proof invitation. type: string format: date-time example: null nullable: true is_platform_admin: description: >- Server-resolved platform authority. Clients must treat false or missing as no platform authority and must not infer this grant from persisted roles or legacy ids. type: boolean example: false activation_code: description: Pending activation token — null after activation. type: string example: null nullable: true activated_at: type: string format: date-time example: '2024-06-15T10:00:00Z' nullable: true last_login: type: string format: date-time example: '2026-04-29T14:01:00Z' nullable: true email_verified_at: type: string format: date-time example: '2024-06-15T10:00:00Z' nullable: true created_at: type: string format: date-time example: '2024-06-15T09:50:00Z' updated_at: type: string format: date-time example: '2026-04-29T14:01:00Z' type: object UnauthorizedResponse: title: UnauthorizedResponse description: >- Returned with HTTP 401 when the request lacks a valid Passport bearer token, a valid `X-HYS-API-Key`, or a valid session. The body is the simple `{message, status}` envelope emitted by `AuthenticateApiOrKey`. required: - message - status properties: message: description: >- Always the literal string `Unauthorized` from the `auth.api_or_key` middleware. Login endpoints return `Invalid Credentials` instead. type: string example: Unauthorized status: type: string example: error type: object ErrorResponse: title: ErrorResponse description: >- Generic error envelope used by most controllers. Most error responses pair a human-readable `message` with `status: error`. Some endpoints additionally include `errors` (validator errors), `error` (legacy single-error string), `code`, or domain-specific context fields. required: - message properties: message: description: Human-readable error message. type: string example: Something went wrong. Please try again. status: description: >- Always the literal string `error` for failures. Some endpoints omit this field. type: string example: error error: description: Legacy single error code/string used by older endpoints. type: string example: invalid_request nullable: true code: description: >- Optional application-level error code (not all endpoints populate this). type: string example: DONOR_NOT_FOUND nullable: true type: object securitySchemes: bearerAuth: type: http description: Passport bearer token authentication for legacy admin sessions. scheme: bearer bearerFormat: JWT apiKeyAuth: type: apiKey description: Gratona API key sent with the compatibility header X-HYS-API-Key. name: X-HYS-API-Key in: header ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.