> ## Documentation Index
> Fetch the complete documentation index at: https://compass.docs.sunnyscoach.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Validate Session

> Protected route that returns the user object from the request body when the session is valid. Requires authentication and appropriate role middleware.

Validate an existing session token and return the user object. Protected route that returns the user object from the request body when the session is valid. Requires authentication and appropriate role middleware.

## Request

### Headers

| Name          | Type   | Required | Description      |
| ------------- | ------ | -------- | ---------------- |
| Authorization | string | Yes      | Bearer token     |
| Content-Type  | string | Yes      | application/json |

### Request Body

```json theme={null}
{
  "user": {
    "_id": "64b7f1a2e4b0a5d3f9c12345",
    "emails": "user@example.com",
    "role": "user"
  }
}
```

### Request Body Schema

| Field | Type   | Required | Description             |
| ----- | ------ | -------- | ----------------------- |
| user  | object | Yes      | User object to validate |

## Response

### 200 OK - Session valid

Returns the user object.

```json theme={null}
{
  "data": {
    "user": {
      "_id": "64b7f1a2e4b0a5d3f9c12345",
      "emails": "user@example.com",
      "role": "user"
    }
  }
}
```

### 401 Unauthorized

```json theme={null}
{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid or expired session token"
  }
}
```

### 500 Internal Server Error

```json theme={null}
{
  "error": {
    "code": "SERVER_ERROR",
    "message": "Internal server error"
  }
}
```

## Example

```bash theme={null}
curl -X POST 'http://localhost:2000/auth/validate-session' \
  -H 'Authorization: Bearer your-jwt-token' \
  -H 'Content-Type: application/json' \
  -d '{
    "user": {
      "_id": "64b7f1a2e4b0a5d3f9c12345",
      "emails": "user@example.com",
      "role": "user"
    }
  }'
```

## Notes

* This endpoint requires a valid JWT token in the Authorization header
* The request body should contain the user object you want to validate
* This is useful for checking if a session is still active and valid
* The endpoint validates both the token and the user object in the request body
* Use this to implement session refresh logic in your application


## OpenAPI

````yaml POST /auth/validate-session
openapi: 3.0.3
info:
  title: COMPASS API
  version: 1.0.0
  description: OpenAPI specification for the Compass backend routes.
servers:
  - url: http://localhost:2000
    description: Local development server
security: []
tags:
  - name: Auth
    description: >-
      Authentication and session management endpoints (OAuth and session
      validation)
  - name: Users
    description: Operations for managing user records
  - name: Departments
    description: Operations for managing departments
  - name: Email Meter
    description: APIs to get Email Meter Stats
  - name: HubSpot Tickets
    description: Feedback APIs
  - name: Permissions
    description: Permissions APIs
  - name: Transcription
    description: Transcription APIs
paths:
  /auth/validate-session:
    post:
      tags:
        - Auth
      summary: Validate an existing session token and return the user object
      description: >-
        Protected route that returns the user object from the request body when
        the session is valid. Requires authentication and appropriate role
        middleware.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ValidateSessionPayload'
      responses:
        '200':
          description: Session valid — returns the user
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      user:
                        $ref: '#/components/schemas/UserMinimal'
        '401':
          description: Unauthorized or invalid session
        '500':
          description: Server error
      security:
        - bearerAuth: []
components:
  schemas:
    ValidateSessionPayload:
      type: object
      properties:
        user:
          $ref: '#/components/schemas/UserMinimal'
    UserMinimal:
      type: object
      properties:
        _id:
          type: string
        emails:
          type: string
          example: user@example.com
        role:
          type: string
          example: user
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT

````