One route: inspect the token you are holding. Always allowed, so any integration can discover its own store, role and access tree — and check a path before calling it.
POST/api/auth
Returns data of given token.
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
store | string | optional | Preferred in header, but store ID can be also used in request body. |
mask | list | optional | filters response - credits | coupons | referrals |
access | string | optional | check access to given branch of API. |
Sample request
{
"access": "public/content"
}Returns the token's own record. With access set to a route path it also answers whether this token may call that route (valid).