{"you_are":"viewer","authenticated":false,"as":null,"how":"Authorization: Bearer <token>","admin_available_on_this_instance":true,"roles":{"viewer":["read"],"analyst":["analyse","read"],"admin":["admin:write","analyse","read"]},"mechanism":"A role is proved by a token signed with HMAC-SHA256 under a secret held only by the operator. The signature covers the role AND the expiry, the algorithm is fixed by the verifier rather than named in the token, and the comparison is constant-time. There is no password store, because there are no users: identity here means holding the secret.","if_unavailable":null,"residual":"A bearer token is usable by whoever holds it until it expires. Lifetimes are short by default and /admin/tokens/revoke refuses an id early, but the revocation set is process memory and clears on restart."}