# Describe the authenticated identity behind the current request

A first-party session or a legacy user token returns the user as before. Organization- and platform-owned API keys authenticate as the Tenant or Platform, so a whitelisted shape is returned instead of the raw model to avoid leaking internal fields (e.g. the tenant's database name).

## Responses[​](#responses "Direct link to Responses")

* 200
* 401

`User`

Unauthenticated