> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tai42.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# The caller's capability projection

> The authenticated caller's derived capability projection — the concrete routes,
dynamic patterns, sub-MCP mounts, tools, and agents it can reach right now (derived,
never stored).

``user_id``/``effective_scopes``/``claims`` are the caller's OWN identity, derived at
the HTTP edge from the authenticated request — never caller-supplied. This is
``caller_context=True`` (tier-1, never projectable): as an MCP tool a caller would
supply those identity params itself and read ANY principal's projection, so the HTTP
route (``/api/auth/me``, whose extractor derives them from ``request.user``) is the
only surface. With the gate OFF there is no identity to project (the edge passes
``user_id=None``), so a synthetic TOTAL projection is returned; otherwise the
projection is built through the REAL enforcer so it can never advertise a door the
gate would deny. Any infrastructure error propagates per the projection's failure
doctrine.



## OpenAPI

````yaml /openapi.json get /api/auth/me
openapi: 3.1.0
info:
  description: The operator HTTP surface served under /api/*.
  title: tai42-skeleton API
  version: 0.1.1
servers: []
security: []
paths:
  /api/auth/me:
    get:
      tags:
        - access-control
      summary: The caller's capability projection
      description: >-
        The authenticated caller's derived capability projection — the concrete
        routes,

        dynamic patterns, sub-MCP mounts, tools, and agents it can reach right
        now (derived,

        never stored).


        ``user_id``/``effective_scopes``/``claims`` are the caller's OWN
        identity, derived at

        the HTTP edge from the authenticated request — never caller-supplied.
        This is

        ``caller_context=True`` (tier-1, never projectable): as an MCP tool a
        caller would

        supply those identity params itself and read ANY principal's projection,
        so the HTTP

        route (``/api/auth/me``, whose extractor derives them from
        ``request.user``) is the

        only surface. With the gate OFF there is no identity to project (the
        edge passes

        ``user_id=None``), so a synthetic TOTAL projection is returned;
        otherwise the

        projection is built through the REAL enforcer so it can never advertise
        a door the

        gate would deny. Any infrastructure error propagates per the
        projection's failure

        doctrine.
      operationId: get_api_auth_me
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  data:
                    $ref: '#/components/schemas/ProjectionResult'
                required:
                  - data
                type: object
          description: Success.
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Missing or invalid api key.
      security:
        - ApiKeyAuth: []
components:
  schemas:
    ProjectionResult:
      description: >-
        The caller's derived capability projection — every field derived, never
        stored.
      properties:
        admin:
          title: Admin
          type: boolean
        agents:
          items:
            type: string
          title: Agents
          type: array
        mintable:
          title: Mintable
          type: boolean
        owner_user_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Owner User Id
        route_patterns:
          items:
            $ref: '#/components/schemas/PatternEntry'
          title: Route Patterns
          type: array
        routes:
          items:
            $ref: '#/components/schemas/RouteEntry'
          title: Routes
          type: array
        scopes:
          items:
            type: string
          title: Scopes
          type: array
        sub_mcp:
          items:
            $ref: '#/components/schemas/SubMcpEntry'
          title: Sub Mcp
          type: array
        tools:
          items:
            type: string
          title: Tools
          type: array
        user_id:
          title: User Id
          type: string
      required:
        - user_id
        - owner_user_id
        - admin
        - scopes
        - routes
        - route_patterns
        - sub_mcp
        - tools
        - agents
        - mintable
      title: ProjectionResult
      type: object
    Error:
      properties:
        error:
          type: string
      required:
        - error
      type: object
    PatternEntry:
      description: >-
        A dynamic route pattern the caller can reach — a mount/pattern surface
        that is

        NOT enumerable into concrete paths, projected only when its scope AND jq
        admit it.
      properties:
        pattern:
          title: Pattern
          type: string
        scope_id:
          title: Scope Id
          type: string
      required:
        - pattern
        - scope_id
      title: PatternEntry
      type: object
    RouteEntry:
      description: >-
        A concrete route the caller can reach, with the methods that pass its
        jq.
      properties:
        methods:
          items:
            type: string
          title: Methods
          type: array
        path:
          title: Path
          type: string
      required:
        - path
        - methods
      title: RouteEntry
      type: object
    SubMcpEntry:
      description: A sub-MCP mount the caller can reach.
      properties:
        slug:
          title: Slug
          type: string
        tools:
          items:
            type: string
          title: Tools
          type: array
        transport:
          title: Transport
          type: string
      required:
        - slug
        - tools
        - transport
      title: SubMcpEntry
      type: object
  securitySchemes:
    ApiKeyAuth:
      in: header
      name: x-api-key
      type: apiKey

````