User Profile

Fetch the currently authenticated user's profile in a single call: identity, role, group, remaining quota, request count, affiliate state, and sidebar permissions. The response is a deliberately whitelisted projection of the user record, not the raw database row.

Authentication

This endpoint sits behind the standard user-auth middleware and requires both headers:

Example request

curl -s 'https://buzzai.cc/api/user/self' \
  -H "Authorization: Bearer $BUZZ_ACCESS_TOKEN" \
  -H "Buzz-User: 1"

import os, requests

resp = requests.get(
    "https://buzzai.cc/api/user/self",
    headers={
        "Authorization": f"Bearer {os.environ['BUZZ_ACCESS_TOKEN']}",
        "Buzz-User": "1",
    },
    timeout=10,
)
resp.raise_for_status()
profile = resp.json()["data"]
print(profile["username"], profile["group"], profile["quota"])

const resp = await fetch("https://buzzai.cc/api/user/self", {
  headers: {
    Authorization: `Bearer ${process.env.BUZZ_ACCESS_TOKEN}`,
    "Buzz-User": "1",
  },
});
const { data } = await resp.json();
console.log(data.username, data.group, data.quota);

Response (live, redacted)

{
  "success": true,
  "message": "",
  "data": {
    "id": 1,
    "username": "buzz666",
    "display_name": "buzz666",
    "role": 100,
    "status": 1,
    "email": "",
    "github_id": "<REDACTED_NUMERIC_ID>",
    "discord_id": "",
    "oidc_id": "",
    "wechat_id": "",
    "telegram_id": "",
    "linux_do_id": "",
    "group": "enterprise",
    "quota": 29214128,
    "used_quota": 588097249,
    "request_count": 398916,
    "aff_code": "tYxh",
    "aff_count": 0,
    "aff_quota": 0,
    "aff_history_quota": 0,
    "inviter_id": 0,
    "setting": "{\"notify_type\":\"email\",\"quota_warning_threshold\":100000,\"gotify_priority\":0,\"record_ip_log\":true}",
    "stripe_customer": "",
    "sidebar_modules": "",
    "permissions": {
      "sidebar_modules": {},
      "sidebar_settings": false
    }
  }
}

Verified live against buzzai.cc on 2026-05-26.

Response envelope

data fields

The response is a hand-crafted whitelist, not a serialised user row. Sensitive columns such as password, access_token, verification_code, and admin-only remark are deliberately stripped before serialisation.

Fields deliberately excluded

The handler explicitly enumerates the fields above instead of serialising the user row, so the following columns are never included in the response, even for the root account:

• password, original_password — credentials
• access_token — the user's own access token (you already have it; the API never echoes it back)
• verification_code — transient signup/email code
• remark — admin-only note, cleared server-side before any caller sees it
• deleted_at, created_at, last_login_at, last_active_at — internal lifecycle timestamps

Errors

See also

• Billing endpoints — convert quota to currency, fetch usage
• GET /api/token/ — manage sk- API tokens
• Authentication guide — access tokens vs. user tokens