List my accessible companies
Lists the companies the Bearer-authenticated user may act on — each with
the user’s role on it — plus the user’s defaultCompanyId (their sticky
active-company pointer) as the suggested default selection.
Unlike every other endpoint, this one is not company-scoped: it
precedes company selection. It is the entry point of the MCP
company-selection flow (list_companies) — the caller uses it to discover
which companyId to pass to the company-scoped endpoints.
Authentication: user-principal Bearer only. Send a user-scoped Auth0
access token as Authorization: Bearer <jwt>. An API key is not accepted
here (an API key is scoped to a single company and has no notion of “my
companies”); a request without a valid user Bearer token returns 401.
The roster contains only the companies the user holds a real, assigned
role on. A user who is a member of no company gets an empty list (a
200, not an error).
Authorizations
User-principal OAuth 2.0 Bearer authentication. Send a user-scoped Auth0 access token (audience = the app API audience) as Authorization: Bearer <jwt>. The request resolves to the user's identity and is authorized by their Role on the {companyId} in the path — the same role-based permissions the web app enforces. This is the path the MCP connector uses to act on a user's behalf; endpoints that accept it list both BearerAuth and ApiKeyAuth.
Response
The user's accessible companies and default selection.
Every company the user holds a real, assigned role on. Empty if the user is a member of no company.
The user's sticky active-company pointer, as a suggested default. null if unset. It is only a suggestion — honor it only when it appears in companies (the pointer can dangle at a company the user no longer belongs to).
