Check Authorized Subuser Is Authorized

This endpoint verifies whether the currently authenticated user holds authorized subuser status within the Netevia banking platform. It checks the permissions and authorization state of the caller to confirm they have the required access rights. Use this endpoint to gate access to subuser-restricted features before attempting sensitive operations.

Endpoint

GET /api/subProfiles/isAuthorizedSubUser

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Call this endpoint before allowing an authorized user to perform actions that are restricted to subusers on a business account. It is particularly useful for client-side permission checks — for example, confirming that a logged-in user is an authorized subuser before displaying subuser-only UI controls or initiating subuser-scoped transfers. It also supports audit and security flows that need to validate authorization status in real time.

Response

200 OK

Returns a single boolean value.

true

Error Codes

Common Mistakes

• Calling this endpoint with a token issued for a personal customer — subusers (authorized users) exist only on business accounts, so the response will be false for personal account tokens.
• Not refreshing the Bearer token before calling — the token expires after 10 minutes, and an expired token returns 401 rather than a boolean result.
• Treating a false response as an error — the endpoint returns 200 with false when the authenticated user simply does not have authorized subuser status; this is a valid, non-error response.

Related Endpoints

• GET /api/subProfiles — List all authorized subusers (subprofiles) on a business account
• POST /api/subProfiles — Create a new authorized subuser on a business account
• DELETE /api/subProfiles/{subProfileId} — Remove an authorized subuser from a business account

Example

curl -X GET https://api.banking.netevia.dev/api/subProfiles/isAuthorizedSubUser \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json"