# GET /v2/aiassistant/auth-context Aktuellen Berechtigungs- und Revisionskontext lesen Erfordert authentifizierten Admin- oder API-Kontext und liefert nur die wirksamen Kontoberechtigungen, readOnly, öffentliche Konto-/Admin-ID und eine Mutationsrevision. Admin-Kontext erfordert eine gültige Admin-ID. Der Snapshot wartet auf aktive Schreiber und initialisiert bei Bedarf den Revisionsdatensatz. Berechtigungen sind kein Grant und dürfen weder erweitert noch aus Modelltext übernommen werden. mcpEndpoint ist nur bei vorhandener vertrauenswürdiger Laufzeitbindung enthalten; private no-store-Antwort. - Operation-ID: get_v2_aiassistant_auth_context - Dokumentation: /docs/api/v2/operations/get-v2-aiassistant-auth-context-7eb523dd8b22/ - OpenAPI-Version: 3.2.1 - Vollständige Spezifikation: /docs/api/v2/openapi.json - Dokumentationsstatus: reviewed - Ändert Zustand: ja - Für Automation freigegeben: nein ## Server Serverwerte stammen unverändert aus der Datei. Eine lokale Entwicklungsadresse ist keine bestätigte Produktionsadresse. `API_ORIGIN` muss auf die passende Instanz gesetzt werden. ```json [ { "url": "https://app2.edoobox.com", "description": "edoobox API" } ] ``` ## Authentifizierung Eine der folgenden Alternativen genügt (ODER). Innerhalb einer Alternative müssen alle Verfahren gemeinsam erfüllt sein (UND). 1. **bearerAuth** (HTTP bearer) — Existing edoobox v2 access token. Never substitute API key/secret headers. **UND** **accountContext** (header: edid) — Selected login/account context from the JWT, not a database primary key. Required even for a JWT with one account. 2. **sessionCookie** (cookie: _edlogin) — Existing browser login session, with the same permission checks as Bearer authentication. **UND** **accountContext** (header: edid) — Selected login/account context from the JWT, not a database primary key. Required even for a JWT with one account. ### Wirksame Security Requirements und vollständige Verfahren ```json { "security": [ { "bearerAuth": [], "accountContext": [] }, { "sessionCookie": [], "accountContext": [] } ], "securitySchemes": { "bearerAuth": { "type": "http", "scheme": "bearer", "bearerFormat": "JWT", "description": "Existing edoobox v2 access token. Never substitute API key/secret headers." }, "accountContext": { "type": "apiKey", "in": "header", "name": "edid", "description": "Selected login/account context from the JWT, not a database primary key. Required even for a JWT with one account." }, "sessionCookie": { "type": "apiKey", "in": "cookie", "name": "_edlogin", "description": "Existing browser login session, with the same permission checks as Bearer authentication." } } } ``` ## Parameter | Name | Ort | Pflicht | Beschreibung | | --- | --- | --- | --- | | language | header | nein | Account language code, where the resource supports setLanguage(). | ### Vollständige wirksame Parameterdefinitionen ```json [ { "name": "language", "in": "header", "required": false, "description": "Account language code, where the resource supports setLanguage().", "schema": { "type": "string", "examples": [ "de" ] } } ] ``` ## Anfrage Kein Request Body deklariert. ## Antworten HTTP-Status und Antwortinhalt gemeinsam auswerten. Die folgenden Beschreibungen und Schemata sind die Angaben der Quelldatei. ```json { "200": { "description": "Authentifizierter, kontogebundener Berechtigungs-Snapshot mit Revisions- und Uploadpfad-Hashes; keine Roh-DB-IDs oder Anmeldedaten.", "content": { "application/json": { "example": { "success": true, "error": false, "data": { "authenticated": true, "edid": "synthetic-context", "mutationRevision": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "readOnly": false, "permissions": { "offe": 1 }, "uploadPathHashes": { "mail": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", "file": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc" }, "authorizationVersion": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd", "account_id": "account_012345abcdef_123456", "admin_id": "admin_012345abcdef_123456" } }, "schema": { "type": "object", "properties": { "success": { "type": "boolean" }, "error": { "type": [ "boolean", "string" ] }, "error_code": { "type": "string" }, "data": { "type": "object", "properties": { "authenticated": { "const": true }, "edid": { "type": "string" }, "mutationRevision": { "type": "string", "pattern": "^[a-f0-9]{32}$" }, "readOnly": { "type": "boolean" }, "permissions": { "type": "object", "additionalProperties": { "type": "integer", "minimum": 0, "maximum": 4 } }, "uploadPathHashes": { "type": "object", "properties": { "mail": { "type": "string" }, "file": { "type": "string" } }, "additionalProperties": true }, "authorizationVersion": { "type": "string" }, "account_id": { "type": "string", "pattern": "^account_[a-f0-9]{12}_-?[0-9]+$", "description": "Öffentliche v2-ID aus dem ausgewählten Konto; keine interne Datenbank-ID." }, "admin_id": { "type": "string", "pattern": "^admin_[a-f0-9]{12}_-?[0-9]+$", "description": "Öffentliche v2-ID aus dem ausgewählten Konto; keine interne Datenbank-ID." }, "mcpEndpoint": { "type": "object", "properties": { "id": { "type": "string" }, "origin": { "type": "string", "format": "uri" } }, "required": [ "id", "origin" ], "additionalProperties": false, "description": "Optionale vertrauenswürdige Endpoint-Laufzeitbindung; keine vom Aufrufer wählbare Zieladresse." } }, "additionalProperties": true }, "type": { "type": "string" } }, "additionalProperties": true } } } }, "400": { "description": "Invalid request.", "content": { "application/json": { "example": { "success": false, "error": "ED40006" } } } }, "401": { "description": "Missing/expired token, missing account context, account paused or model-specific authorization failure.", "content": { "application/json": { "example": { "success": false, "error": "ED40103" } } } }, "402": { "description": "Missing/invalid action data or subscription/operation restriction.", "content": { "application/json": { "example": { "success": false, "error": "ED80100" } } } }, "403": { "description": "Permission denied. Browser CORS rejection may have an empty body.", "content": { "application/json": { "example": { "success": false, "error": "ED40340" } } } }, "404": { "description": "Unknown resource/action or unsupported method.", "content": { "application/json": { "example": { "success": false, "error": "ED80019" } } } }, "422": { "description": "Validation failed.", "content": { "application/json": { "example": { "success": false, "error": "ED80020" } } } }, "429": { "description": "Request/login rate limit exceeded. Honor Retry-After when supplied; legacy rate-limit paths may omit it. Retry only proven reads within a bounded deadline; a mutation is never automatically replayed after an ambiguous response.", "content": { "application/json": { "example": { "success": false, "error": "ED42902" } } }, "headers": { "Retry-After": { "description": "Optional server delay in whole seconds or an HTTP date. Absence is not permission for an immediate retry.", "schema": { "type": "string", "examples": [ "30" ] } } } }, "502": { "description": "Server-side operation failed.", "content": { "application/json": { "example": { "success": false, "error": "ED50201" } } } } } ``` ## Aufrufbeispiele Anpassen vor dem Ausführen. Platzhalter und veröffentlichte Beispiele sind synthetisch. Die Beispiele senden hier keine Anfrage; sie ergänzen keine unbekannten Pflichtfelder. ### cURL ```sh # Zeigt Authentifizierungsalternative 1; alle Verfahren dieser Alternative sind gemeinsam erforderlich. : "${API_ORIGIN:?API_ORIGIN setzen}" : "${AUTH_BEARERAUTH:?AUTH_BEARERAUTH setzen}" : "${AUTH_ACCOUNTCONTEXT:?AUTH_ACCOUNTCONTEXT setzen}" curl --request 'GET' \ --url "${API_ORIGIN%/}"'/v2/aiassistant/auth-context' \ --header 'Authorization: Bearer '"${AUTH_BEARERAUTH}" \ --header 'edid: '"${AUTH_ACCOUNTCONTEXT}" ``` ### JavaScript (Node.js) ```javascript // Zeigt Authentifizierungsalternative 1; alle Verfahren dieser Alternative sind gemeinsam erforderlich. const required = (name) => { const value = process.env[name]; if (!value) throw new Error(`Set ${name}`); return value; }; let path = "/v2/aiassistant/auth-context"; const origin = required('API_ORIGIN'); const url = new URL((origin.endsWith('/') ? origin.slice(0, -1) : origin) + path); const headers = {}; headers["Authorization"] = "Bearer " + required("AUTH_BEARERAUTH"); headers["edid"] = "" + required("AUTH_ACCOUNTCONTEXT"); const response = await fetch(url, { method: "GET", headers, redirect: 'manual' }); const text = await response.text(); console.log(response.status, text); // HTTP-Status und dokumentierte error/success-Felder gemeinsam prüfen. ``` ### Python ```python # Zeigt Authentifizierungsalternative 1; alle Verfahren dieser Alternative sind gemeinsam erforderlich. import os import urllib.parse import urllib.request import urllib.error path = "/v2/aiassistant/auth-context" url = os.environ["API_ORIGIN"].rstrip("/") + path headers = {} headers["Authorization"] = "Bearer " + os.environ["AUTH_BEARERAUTH"] headers["edid"] = "" + os.environ["AUTH_ACCOUNTCONTEXT"] # Redirects nicht automatisch verfolgen. class NoRedirect(urllib.request.HTTPRedirectHandler): def redirect_request(self, req, fp, code, msg, headers, newurl): return None request = urllib.request.Request(url, headers=headers, method="GET") try: response = urllib.request.build_opener(NoRedirect).open(request, timeout=30) except urllib.error.HTTPError as error: response = error print(response.status, response.read().decode("utf-8", errors="replace")) # HTTP-Status und dokumentierte error/success-Felder gemeinsam prüfen. ``` ## Vollständige Operationsdefinition und edoobox-Hinweise Alle Originalfelder einschliesslich `x-edoobox-*`, requestBody und responses bleiben erhalten. Teilweise dokumentierte Schemata sind kein vollständiger Validierungsvertrag. ```json { "operationId": "get_v2_aiassistant_auth_context", "summary": "Aktuellen Berechtigungs- und Revisionskontext lesen", "description": "Erfordert authentifizierten Admin- oder API-Kontext und liefert nur die wirksamen Kontoberechtigungen, readOnly, öffentliche Konto-/Admin-ID und eine Mutationsrevision. Admin-Kontext erfordert eine gültige Admin-ID. Der Snapshot wartet auf aktive Schreiber und initialisiert bei Bedarf den Revisionsdatensatz. Berechtigungen sind kein Grant und dürfen weder erweitert noch aus Modelltext übernommen werden. mcpEndpoint ist nur bei vorhandener vertrauenswürdiger Laufzeitbindung enthalten; private no-store-Antwort.", "tags": [ "aiassistant" ], "security": [ { "bearerAuth": [], "accountContext": [] }, { "sessionCookie": [], "accountContext": [] } ], "parameters": [ { "name": "language", "in": "header", "required": false, "description": "Account language code, where the resource supports setLanguage().", "schema": { "type": "string", "examples": [ "de" ] } } ], "responses": { "200": { "description": "Authentifizierter, kontogebundener Berechtigungs-Snapshot mit Revisions- und Uploadpfad-Hashes; keine Roh-DB-IDs oder Anmeldedaten.", "content": { "application/json": { "example": { "success": true, "error": false, "data": { "authenticated": true, "edid": "synthetic-context", "mutationRevision": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "readOnly": false, "permissions": { "offe": 1 }, "uploadPathHashes": { "mail": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", "file": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc" }, "authorizationVersion": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd", "account_id": "account_012345abcdef_123456", "admin_id": "admin_012345abcdef_123456" } }, "schema": { "type": "object", "properties": { "success": { "type": "boolean" }, "error": { "type": [ "boolean", "string" ] }, "error_code": { "type": "string" }, "data": { "type": "object", "properties": { "authenticated": { "const": true }, "edid": { "type": "string" }, "mutationRevision": { "type": "string", "pattern": "^[a-f0-9]{32}$" }, "readOnly": { "type": "boolean" }, "permissions": { "type": "object", "additionalProperties": { "type": "integer", "minimum": 0, "maximum": 4 } }, "uploadPathHashes": { "type": "object", "properties": { "mail": { "type": "string" }, "file": { "type": "string" } }, "additionalProperties": true }, "authorizationVersion": { "type": "string" }, "account_id": { "type": "string", "pattern": "^account_[a-f0-9]{12}_-?[0-9]+$", "description": "Öffentliche v2-ID aus dem ausgewählten Konto; keine interne Datenbank-ID." }, "admin_id": { "type": "string", "pattern": "^admin_[a-f0-9]{12}_-?[0-9]+$", "description": "Öffentliche v2-ID aus dem ausgewählten Konto; keine interne Datenbank-ID." }, "mcpEndpoint": { "type": "object", "properties": { "id": { "type": "string" }, "origin": { "type": "string", "format": "uri" } }, "required": [ "id", "origin" ], "additionalProperties": false, "description": "Optionale vertrauenswürdige Endpoint-Laufzeitbindung; keine vom Aufrufer wählbare Zieladresse." } }, "additionalProperties": true }, "type": { "type": "string" } }, "additionalProperties": true } } } }, "400": { "description": "Invalid request.", "content": { "application/json": { "example": { "success": false, "error": "ED40006" } } } }, "401": { "description": "Missing/expired token, missing account context, account paused or model-specific authorization failure.", "content": { "application/json": { "example": { "success": false, "error": "ED40103" } } } }, "402": { "description": "Missing/invalid action data or subscription/operation restriction.", "content": { "application/json": { "example": { "success": false, "error": "ED80100" } } } }, "403": { "description": "Permission denied. Browser CORS rejection may have an empty body.", "content": { "application/json": { "example": { "success": false, "error": "ED40340" } } } }, "404": { "description": "Unknown resource/action or unsupported method.", "content": { "application/json": { "example": { "success": false, "error": "ED80019" } } } }, "422": { "description": "Validation failed.", "content": { "application/json": { "example": { "success": false, "error": "ED80020" } } } }, "429": { "description": "Request/login rate limit exceeded. Honor Retry-After when supplied; legacy rate-limit paths may omit it. Retry only proven reads within a bounded deadline; a mutation is never automatically replayed after an ambiguous response.", "content": { "application/json": { "example": { "success": false, "error": "ED42902" } } }, "headers": { "Retry-After": { "description": "Optional server delay in whole seconds or an HTTP date. Absence is not permission for an immediate retry.", "schema": { "type": "string", "examples": [ "30" ] } } } }, "502": { "description": "Server-side operation failed.", "content": { "application/json": { "example": { "success": false, "error": "ED50201" } } } } }, "x-edoobox-mutates-state": true, "x-edoobox-server-authorization": true, "x-edoobox-server-authorization-source": { "file": "application/models/v2/Aiassistant.php", "line": 26, "reason": "Dedicated administrator/account identity, ownership, plugin and action-specific settings/billing checks. No legacy permission.short exists; maintenance side effects remain conservatively classified and must not acquire fictitious legacy write permission." }, "x-edoobox-runtimeMutationGuard": false, "x-edoobox-get-effect": "maintenance", "x-edoobox-documentationReview": { "file": "docs/openapi/operation-contracts/09-messages-ai.json", "notes": [] }, "x-edoobox-source": { "file": "application/models/v2/Aiassistant.php", "method": "getAiassistant", "line": 10 }, "x-edoobox-documentationStatus": "reviewed", "x-edoobox-readOnly": false, "x-edoobox-safeForAutomation": false, "x-edoobox-permission": { "resource": "aiassistant", "short": null, "checkedByDispatcher": false, "levels": [ 1, 3, 4 ], "description": "Resource permission mapping from APIPermissions(), Authfunc::_getCheckJWT. Additional model/admin/plugin checks may apply; resources absent from api_permission do not acquire a fictitious scope." } } ```