Reference

account

The caller's own identity, sign-in sessions and re-authentication. Index · shared schemas · errors.

account.get

Who the caller is: the signed-in user, the org API key, or the access token, with its scopes

Input:

{}

Output:

{
  principal: 'user' | 'apiKey' | 'delegated' | …
  user?: User
  signIn?: { password: boolean; providers: { id: string; name: string }[] }
  apiKey?: { id: ApiKeyId; orgId: OrgId; projectId?: ProjectId; scopes: CloudScopeOut[] }
  delegated?: {
    subject: string
    clientId: string
    orgId: OrgId
    projectId?: ProjectId
    audience: string
    scopes: CloudScopeOut[]
    grant: 'code' | 'refresh' | 'device' | 'exchange' | …
    actor?: string
    expiresAt: Timestamp
  }
}

Errors: U.

Named types: ApiKeyId, CloudScopeOut, OrgId, ProjectId, Timestamp, User.

account.sessions

List the signed-in user's active sessions, newest first

Input:

{}

Output:

{ sessions: AuthSessionInfo[] }

Errors: U.

Named types: AuthSessionInfo.

account.revokeSession

Sign out one of the user's own sessions; revoking the current one signs this caller out

Input:

{ sessionId: AuthSessionId }

Output:

{ revoked: boolean }

Errors: U, NOT_FOUND.

Named types: AuthSessionId.

account.reauthenticate

Confirm the user's password on the current session; trust-class procedures then accept it for 15 minutes. A wrong password answers FORBIDDEN (reauth-required) and spends this session's re-auth budget (5 in 15 minutes) and the user's (20 across sessions); a right one spends nothing.

Input:

{ password: Password }

Output:

{ reauthenticatedAt: Timestamp }

Errors: U.

Named types: Password, Timestamp.

account.grants

List the apps the signed-in user let act for them (the CLI's device sign-in, the studio, MCP clients), newest first, with when each was last used

Input:

{}

Output:

{ grants: AccountGrant[] }

Errors: U.

Named types: AccountGrant.

account.revokeGrant

Revoke one of the user's grants: its refresh tokens stop at once, its access tokens within 10 minutes. NOT_FOUND (grant) for another user's or an ended one.

Input:

{ grantId: GrantId }

Output:

{ revoked: boolean }

Errors: U, NOT_FOUND.

Named types: GrantId.