Identity

The signed-in person, their companies and module access (OpenID Connect UserInfo).

Base URL, authentication and conventions of this API are on the OAuth & OpenID Connect API page.

Endpoints

get/api/oauth/userinfoGet the signed-in user

get/api/oauth/userinfo

Get the signed-in user

Requires the openid scope.

OpenID Connect UserInfo. Returns who the token belongs to, the companies (organizations) they belong to and the Nucleo modules they can use, with their role.

sub is the stable user id: key your local records on it, never on email.
orgs[].id is the company id to pass as X-Nucleo-Company to the AI tools.
apps[] lists module access per company (org_id: null = global access for Nucleo staff). During the module migration legacy slugs may appear next to brain, catalog, commerce, intelligence: ignore slugs you do not know.
disabled_sections lists, per company id, the sub-modules switched off for that company. When no company has a sub-module switched off it is an empty array [], not an object.
ai_connector_disabled lists, per company id, the modules whose AI connector that company has switched off (only companies with something switched off; [] when there are none). AI clients get 403 ai_connector_disabled from those modules' AI tools in that company.
scope is the effective scope of the token: nucleo.ai_tools marks a token of a self-registered (AI) client.
org_id is the company of the token (passed to /oauth/authorize), or null; the same value as the org_id claim of the access token. A hint for the active company, not a permission.
impersonator is non-null only when Nucleo staff is acting as the user.
apps[] entries of catalog, commerce and intelligence can also carry role_key, role_name (in the person's language) and permissions (the permission keys of that role).

Available to self-registered clients' tokens. A token of a deactivated account answers 401 with error: invalid_token.

GET https://auth.nucleoplatform.com/api/oauth/userinfo

Authentication: OAuth 2.0 access token or Bearer token

Responses

200The user.application/json
- substringrequired
  Stable user id.
- namestring
- emailstring (email)required
- email_verifiedboolean
- avatar_urlstring (uri) | null
- languagestring
  Example: en
- themestring
  One oflightdark
- is_internalboolean
  True only for Nucleo staff with access to every company.
- is_ownerboolean
- org_idsarray of integer
- orgsarray of object
  Attributes of each item
  idinteger
  slugstring
  namestring
  logo_urlstring (uri) | null
  rolestring
  Example: admin
- app_accessarray of string
  Module slugs the user can open.
- appsarray of object
  Attributes of each item
  slugstring
  Example: catalog
  rolestring
  Example: editor
  org_idinteger | null
  role_keystring
  Key of the role (a preset level or a custom role). Catalog, Commerce and Intelligence only.
  
  Example: editor
  role_namestring
  Role name in the person's language.
  
  Example: Editor
  permissionsarray of string
  Permission keys granted by the role.
- disabled_sectionsobject | array of string
  Company id → list of disabled sub-module slugs. An empty array [] when nothing is switched off.
- ai_connector_disabledobject | array of any
  Company id → modules (brain, catalog, commerce, intelligence) whose AI connector the company has switched off. Only the user's companies with something switched off (every company for Nucleo staff); an empty array [] when there are none. A missing claim means nothing is switched off.
- client_idstring | null
- scopestring
  Effective scopes of the token
- org_idinteger | null
  Company of the token: the org_id passed to /oauth/authorize (when the person belongs to it), kept by every refresh; null otherwise. A missing claim (older Core) means null.
- impersonatorobject | null
  Child attributes
  idinteger
  namestring
  emailstring (email)
  expires_atstring (date-time)
401Missing, expired or revoked access token.application/json
- messagestring

Request

curl -X GET https://auth.nucleoplatform.com/api/oauth/userinfo \
  -H "Authorization: Bearer $NUCLEO_ACCESS_TOKEN" \
  -H 'Accept: application/json'

const res = await fetch("https://auth.nucleoplatform.com/api/oauth/userinfo", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.NUCLEO_ACCESS_TOKEN}`,
    Accept: "application/json",
  },
});
const data = await res.json();
console.log(res.status, data);

<?php

require 'vendor/autoload.php';

$client = new GuzzleHttp\Client();

$response = $client->request('GET', 'https://auth.nucleoplatform.com/api/oauth/userinfo', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('NUCLEO_ACCESS_TOKEN'),
        'Accept' => 'application/json',
    ],
    'http_errors' => false,
]);

echo $response->getStatusCode(), PHP_EOL;
echo $response->getBody();

Response

{
  "sub": "42",
  "name": "Giulia Rossi",
  "email": "giulia.rossi@acme.example",
  "email_verified": true,
  "avatar_url": "https://cdn.acme.example/avatars/42.png",
  "language": "it",
  "theme": "light",
  "is_internal": false,
  "is_owner": false,
  "org_ids": [
    7
  ],
  "orgs": [
    {
      "id": 7,
      "slug": "acme",
      "name": "Acme Apparel",
      "logo_url": "https://cdn.acme.example/logo.png",
      "role": "admin"
    }
  ],
  "app_access": [
    "catalog",
    "commerce"
  ],
  "apps": [
    {
      "slug": "catalog",
      "role": "editor",
      "org_id": 7,
      "role_key": "editor",
      "role_name": "Editor",
      "permissions": [
        "catalog.products.view",
        "catalog.products.edit"
      ]
    },
    {
      "slug": "commerce",
      "role": "viewer",
      "org_id": 7
    }
  ],
  "disabled_sections": {
    "7": [
      "pos"
    ]
  },
  "ai_connector_disabled": {
    "7": [
      "intelligence"
    ]
  },
  "client_id": "9d3f2b1c-6a4e-4f7b-9c2d-1e8a7b6c5d4f",
  "scope": "openid profile email offline_access nucleo.ai_tools",
  "org_id": 7,
  "impersonator": null
}

{
  "message": "Unauthenticated."
}

Was this page helpful?