> ## Documentation Index > Fetch the complete documentation index at: https://docs.cyberun.cloud/llms.txt > Use this file to discover all available pages before exploring further. # Get current user profile > Returns the authenticated user's profile including all teams they belong to. ## OpenAPI ````yaml /api-reference/core-openapi.yaml get /users/me openapi: 3.0.3 info: title: Cyberun API version: 1.0.0 description: > Multi-tenant GPU orchestration platform for enterprise private deployments. ## Authentication Two authentication families are supported: - **JWT Bearer** (`Authorization: Bearer `) — Used by team owners/admins/members for management endpoints and user sessions. JWT-authenticated requests that operate on a team **must** include the `X-Team-ID` header to select which team the request applies to (a user can belong to multiple teams). - **Credential Bearer** (`Authorization: Bearer `) — Unified machine credential. The credential is always scoped to a single team derived from the credential row, and any `X-Team-ID` header is **ignored**. The three kinds differ in identity and routing: | Kind | Prefix | Identity | Allowed surfaces | | ------------- | ------ | ------------------------- | --- | | `integration` | `sk-` | Team only | Runtime API (`/r/`) + the Web MCP endpoint. Rejected on every management endpoint because the authorization layer needs a user identity and `sk-` has none. | | `agent` | `ak-` | Team only | the platform's WebSocket handshake **only** — rejected by the REST surface at the middleware layer. | | `device` | `dk-` | Team + user (per-device) | Runtime API and scoped management endpoints — behaves like a JWT for the underlying user. Issued by the desktop pairing flow only (`POST /desktop/pair/confirm`). | the authorization layer runs against the user identity carried by JWT and `dk-`. `sk-` and `ak-` bypass the authorization layer; service-layer checks enforce team scope for them. Runtime endpoints under `/r/` accept **JWT (with `X-Team-ID`)**, `sk-`, and `dk-`. `ak-` is rejected at the middleware (it is only meaningful on the the platform's WebSocket handshake). Scoped management endpoints accept **JWT (with `X-Team-ID`)** or `dk-`; `sk-` is rejected on management because the the authorization layer authorize layer requires a user identity. The Web MCP endpoint accepts `sk-` only. Multipart upload endpoints (`/uploads/multipart/*`) remain JWT-only. Credential-bearing callers (`sk-`, `dk-`) should use single-part presign (`POST /r/files/presign`) instead — that returns a vanilla S3 PUT URL (≤ 5 GB by S3, subject to the server's configured request cap; default 500 MB). Files beyond the cap currently require the JWT-only multipart flow. ## Task Lifecycle Tasks follow this state machine: `pending → waiting → queued → running → completed | failed | cancelled`. Submit tasks via workflow run endpoints, poll status via GET /r/tasks/{taskId}, and retrieve results via GET /r/tasks/{taskId}/result. ## Pagination All list endpoints support pagination via `current_page` (default: 1) and `per_page` (default: 20, max: 100) query parameters. Responses include a `page_meta` object with `current_page`, `per_page`, and `total_count`. servers: - url: https://core.cyberun.cloud/api/v1 description: Cyberun Cloud API security: [] tags: - name: Auth description: > Authentication and account lifecycle: register, login, logout, token refresh, password reset, and email verification. - name: User description: | Current user profile management: view and update profile, change password. - name: Team description: > Team management: create, update, delete teams, leave, and transfer ownership. Each user gets a personal team on registration. - name: Member description: | Team member management: list members, update roles, and remove members. - name: Invitation description: > Team invitation management: invite users by email, accept/decline invitations, list pending invitations, and cancel invitations. - name: Credential description: | Unified credential management: integration keys (`sk-`) for programmatic API access, agent keys (`ak-`) for headless workers, and device keys (`dk-`) for paired desktop installs. All three share storage and revocation flow; the `kind` field selects behaviour. - name: DevicePair description: > Desktop device pairing flow. Three endpoints — start (anonymous), confirm (JWT, called from the Cyberun dashboard), poll (anonymous, called from desktop) — exchange a short user-visible code for a `dk-` credential without the user ever typing the secret. - name: Workflow description: > ComfyUI workflow template management: create, update, delete, and list workflow templates with configurable parameters, labels, timeout, and retry settings. - name: Task description: | Task execution and monitoring: submit workflow runs, poll task status, retrieve results, and cancel tasks. Tasks follow the lifecycle: `pending → waiting → queued → running → completed | failed | cancelled`. - name: Webhook description: > Webhook management: register HTTPS endpoints to receive event notifications (task.completed, task.failed) with HMAC-SHA256 signed payloads. - name: Container description: > Container service orchestration: deploy arbitrary Docker containers (vLLM, Ollama, custom services) to agents, manage lifecycle, and proxy HTTP requests through the gateway with load balancing. - name: CloudProvider description: > Cloud compute provider management: configure third-party cloud GPU provider API keys (e.g. ComfyUI Cloud) for teams without local GPU agents, and manage automatic cloud fallback settings. - name: Notifications description: | In-app notification center: list, read, and manage notifications for status changes and system alerts. - name: Agent description: > Agent monitoring: view connected agents for a team, including their status, labels, and current task. Data is read from the the platform's runtime state. - name: Node description: | Custom node management: upload, register, update, and delete ComfyUI custom node packages (zip archives) for team-scoped agents. - name: Model description: | Model management: upload, register, update, and delete AI model files (checkpoints, LoRAs, etc.) for team-scoped agents. - name: File description: > File upload for workflow inputs: request presigned upload URLs to stage files (images, videos, audio) in S3, then reference them as `type: file` parameters when running workflows. - name: Upload description: > Multipart upload support for large files: initiate, presign parts, complete, and abort multipart uploads. Used alongside domain-specific presign endpoints for files exceeding ~100 MB. - name: Server description: | Public server information: registration status and other configuration visible to unauthenticated clients. paths: /users/me: get: tags: - User summary: Get current user profile description: >- Returns the authenticated user's profile including all teams they belong to. operationId: getMe responses: '200': description: Current user profile content: application/json: schema: $ref: '#/components/schemas/UserProfile' '401': $ref: '#/components/responses/Unauthorized' security: - bearerAuth: [] - DeviceAuth: [] components: schemas: UserProfile: type: object description: Full profile of the authenticated user. required: - id - first_name - last_name - display_name - email_address - team_list - feature_flags properties: id: type: string format: uuid description: UUID of the user. example: 019abc12-3456-7890-abcd-ef1234567890 first_name: type: string description: User's first (given) name. example: Alice last_name: type: string description: User's last (family) name. example: Chen display_name: type: string description: >- Display name shown in the UI (defaults to "first_name last_name" on registration). example: Alice Chen email_address: type: string format: email description: User's email address. example: alice@example.com team_list: type: array description: Teams the user belongs to. items: $ref: '#/components/schemas/TeamRef' feature_flags: allOf: - $ref: '#/components/schemas/FeatureFlagResponse' description: > Which product features are active on this deployment. Returned here (behind authentication) rather than in `/server-info`, so the catalog of licensed capabilities is not visible to unauthenticated callers. TeamRef: type: object description: Minimal team reference embedded in user profiles. required: - id - display_name properties: id: type: string format: uuid description: UUID of the team. example: 019abc12-4567-7890-abcd-ef1234567891 display_name: type: string description: Team display name. example: Alice's Team FeatureFlagResponse: type: object description: | Per-deployment feature posture for the authenticated user, scoped by namespace. Mirrors ADR-0008 §5.3: * `global` — deployment-wide flags + quotas (one shared block) * `account` — per-user flags + quotas (resolved against the authenticated user's plan) * `teams` — per-team flags + quotas + rate_limits, keyed by team_id. The map contains exactly the teams the authenticated user belongs to. Empty when the user is not a member of any team yet (e.g. between OAuth callback completion and the auto-team creation finalising). required: - global - account - teams properties: global: $ref: '#/components/schemas/GlobalFeatureBlock' account: $ref: '#/components/schemas/AccountFeatureBlock' teams: type: object description: | Map from team UUID string to that team's feature posture. Use `teams[active_team_id]` for the team the UI is currently scoped to. Order is undefined; clients should not rely on it. additionalProperties: $ref: '#/components/schemas/TeamFeatureBlock' ErrorResponse: type: object required: - error_message properties: error_message: type: string description: Human-readable error message describing what went wrong. example: resource not found GlobalFeatureBlock: type: object description: Deployment-wide feature + quota posture. One block per response. required: - features - quotas properties: features: $ref: '#/components/schemas/GlobalFeatureFlags' quotas: $ref: '#/components/schemas/GlobalQuotas' AccountFeatureBlock: type: object description: >- Per-user feature + quota posture, resolved against the authenticated user's plan. required: - features - quotas properties: features: $ref: '#/components/schemas/AccountFeatureFlags' quotas: $ref: '#/components/schemas/AccountQuotas' TeamFeatureBlock: type: object description: Per-team feature posture, quotas, and rate limits. required: - features - quotas - rate_limits properties: features: $ref: '#/components/schemas/TeamFeatureFlags' quotas: $ref: '#/components/schemas/TeamQuotas' rate_limits: $ref: '#/components/schemas/TeamRateLimits' GlobalFeatureFlags: type: object required: - registration - oauth - email - oidc_provider - mcp_server - auto_team - notifications properties: registration: type: boolean description: >- Whether password-based registration is enabled. OAuth signup is gated separately by `oauth`. oauth: type: boolean description: Whether OAuth sign-in (Google, etc.) is licensed. email: type: boolean description: >- Whether outbound email (verification, notifications, invitations) is configured. oidc_provider: type: boolean description: >- Whether Core acts as its own OIDC Provider (issuing tokens to Studio etc.). mcp_server: type: boolean description: Whether the Web MCP endpoint at `/api/v1/mcp` is active. auto_team: type: boolean description: Whether registration auto-creates a default team for the user. notifications: type: boolean description: Whether in-app notifications are enabled. GlobalQuotas: type: object description: Deployment-wide caps. `-1` means unlimited. `0` means disabled. required: - max_users - max_teams - max_agents - max_concurrent_tasks properties: max_users: type: integer format: int64 max_teams: type: integer format: int64 max_agents: type: integer format: int64 max_concurrent_tasks: type: integer format: int64 AccountFeatureFlags: type: object required: - manual_team_creation - team_invitation_accept properties: manual_team_creation: type: boolean description: >- Whether the user can manually create additional teams (beyond the auto-created one). team_invitation_accept: type: boolean description: Whether the user can accept invitations to join other teams. AccountQuotas: type: object description: Per-user caps. `-1` means unlimited. required: - max_owned_teams properties: max_owned_teams: type: integer format: int64 description: Maximum number of teams this user can own. TeamFeatureFlags: type: object required: - webhooks - snapshots - remote_access - custom_models - custom_nodes - container_service - comfy_cloud - nerfstudio - team_invitation_create properties: webhooks: type: boolean snapshots: type: boolean remote_access: type: boolean custom_models: type: boolean description: >- Whether team-uploaded models are enabled. Disabling this also implicitly blocks agent model sync. custom_nodes: type: boolean container_service: type: boolean comfy_cloud: type: boolean description: Whether BYO ComfyCloud provider is enabled for this team. nerfstudio: type: boolean team_invitation_create: type: boolean description: Whether team owners/admins can issue invitations from this team. TeamQuotas: type: object description: Per-team caps. `-1` means unlimited. required: - max_members - max_workflows - max_agents - max_webhooks - max_integration_credentials - max_agent_credentials - max_concurrent_tasks - max_storage_bytes properties: max_members: type: integer format: int64 max_workflows: type: integer format: int64 max_agents: type: integer format: int64 description: >- Maximum number of concurrently-online agents this team can keep connected. max_webhooks: type: integer format: int64 max_integration_credentials: type: integer format: int64 max_agent_credentials: type: integer format: int64 max_concurrent_tasks: type: integer format: int64 max_storage_bytes: type: integer format: int64 TeamRateLimits: type: object description: | Per-minute rate limits for this team's routes. Semantics: * -1 — bypass: no limit applied (internal / unlimited plans) * 0 — fall through to the server-side middleware default (also the on-prem return value, since on-prem plans don't carry rate_limits) * >0 — explicit sliding-window cap (requests per minute) The rate-limit middleware is the authority on the `0` branch. Frontends MUST NOT render `0` as "this team has no quota" — render it as "default" or omit the value. required: - runtime_per_minute - chat_per_minute properties: runtime_per_minute: type: integer format: int64 chat_per_minute: type: integer format: int64 responses: Unauthorized: description: 'Authentication failed: missing, expired, or invalid JWT/API key.' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: | User session JWT (Bearer ). Must be paired with the `X-Team-ID` request header on team-scoped endpoints so the server knows which team's resources to operate on. DeviceAuth: type: http scheme: bearer description: > Device credential (Bearer dk-...) issued by the client device-pair flow (`POST /desktop/pair/confirm`). Carries the confirming user's identity, so it behaves like the user's JWT on team-scoped endpoints — the authorization layer runs against the user. Accepted on runtime + management endpoints. Never accepted on the platform's WebSocket. Team scope is bound at pair time; `X-Team-ID` is ignored. ````