Get my user schema
The schema the signed-in user's own record is validated against.
With project_id, the schema is returned only when the session belongs to
that project.
sessionCookie__Host-zitadel_session<token>The session cookie issued at session creation or superseding handoff exchange.
A browser holds it as __Host-zitadel_session, with Secure. Over plain
http to a loopback host (localhost, 127.0.0.1, ::1) the server sets it
as zitadel_session instead, without Secure or the prefix, so that Safari
keeps it, and accepts that name there too; __Host-zitadel_session takes
precedence. A program sends __Host-zitadel_session over any transport.
A missing or invalid cookie yields 401 with code auth.unauthorized and the message
Missing or invalid session token.
Cross-site request forgery (ADR 053 §5): a state-changing request that this
cookie authenticates must come from the same origin — a cross-site browser
request is refused with 403 and code auth.csrf_invalid. Every such
request must also send the session's token from GET /sessions/me/csrf in the
X-Zitadel-CSRF header, or it answers the same 403. The only exceptions are
the POST …/query reads, which need no token. Safe methods (GET) are not checked. A request a project secret
authenticates is not affected.
project_id?stringThe project the caller signs its users in to. The cookie's session is used
only when it belongs to this project; a session of any other project answers
403 with sess.project_mismatch.
A session belongs to one project, while a browser sends its cookie to every app on the same host. An app passes its own project, so that a session of another project never reads or acts as one of its users, and signing out of the app never ends it. The SDKs pass it when they read the session or sign out.
sess.project_mismatch does not mean the session is invalid: it is live in
its own project, so keep its cookie.
^[a-zA-Z0-9_-]+$The user's schema.
application/json- response
A schema resource: the server-owned envelope around a customer-authored JSON Schema document.
schema is the customer-authored document, served verbatim: its keys and
contents are defined entirely by its author. The rest of the object — id,
metadata — is the server-owned envelope. Keeping the two apart means the
document may declare any property (including id or metadata) without
colliding with the envelope, and the resource id stays distinguishable
from the document's own $id.
id*stringThe resource id: the server-minted sch_* identifier, or the
customer-supplied $id URI when the document declared one at creation.
schema*The customer-authored JSON Schema document, served verbatim.
metadata*import { configureZitadel, getApi } from "@zitadel/api/config";// In the browser, through the SDK proxy: the session cookie authenticates the call.const client = getApi(configureZitadel({ projectId: "proj_01KWH1P4MYS7F0N9WD3P2E4YM5" }));const myUserSchema = await client.getMyUserSchema();{ "id": "string", "schema": { "$schema": "https://json-schema.org/draft/2020-12/schema", "objectType": "string", "kind": "user-schema", "metaSchema": "http://example.com", "x-auth-methods": { "password": { "enabled": true }, "passkey": { "enabled": true }, "magic_link": { "enabled": true }, "sso": { "providers": [ "google" ], "enabled": true }, "otp": { "enabled": true } }, "x-identifier": "string", "x-display": [ "string" ], "properties": { "property1": { "x-unique": "unspecified", "x-claim": "string", "x-audit": false, "properties": { "property1": {}, "property2": {} } }, "property2": { "x-unique": "unspecified", "x-claim": "string", "x-audit": false, "properties": { "property1": {}, "property2": {} } } } }, "metadata": { "created_at": "2019-08-24T14:15:22Z", "in_use": true }}Was this helpful?