Resolve an owner handle to a user or org profile

GET/api/owners/{handle}

getOwnerProfile

Handles live in a single global namespace shared by user accounts and organization workspaces. This endpoint returns whichever the handle resolves to so the SPA can render `/[handle]` without two probes.

Authentication is not described for this operation in the spec — that does not mean it is public. Check tokens and scopes.

curl

curl -X GET 'https://neosource.dev/api/owners/HANDLE'

fetch

fetch("https://neosource.dev/api/owners/HANDLE", {
  method: "GET",
});

Path parameters

handlerequired: Handle of the owner — either a user account or an organization.
string

Responses

200Owner profile

application/json

OwnerResponse

object

Unified profile response for any owner handle. `account_id` is set when the handle is a user; orgs have only `workspace_id`. `viewer_role` is populated for org handles when the caller is a member.

account_id: string | null
avatar_url: string | null
Absolute avatar URL on the content origin, for users and organizations (issue #716, plans/org-avatars-2026-10.md); absent for an owner with no avatar. Same shape as `UserResponse::avatar_url`.
created_atrequired: integerint64
descriptionrequired: string
display_namerequired: string
handlerequired: string
kindrequired: OwnerKind
string
What kind of entity a handle resolves to. Handles live in a single namespace shared by user accounts and organization workspaces, so the SPA needs to know which side a given handle landed on.
"user""organization"
platform_workspace: one of
PlatformWorkspace
string
A workspace the platform owns and operates, named by its fixed handle: [`MIRROR_OWNER_HANDLE`] or [`CORPUS_OWNER_HANDLE`]. On the wire as `OwnerResponse.platform_workspace`, so the SPA asks "is this the mirror archive?" of a typed field rather than comparing handles. `_corpus` is not a reachable profile (ADR 0163 D10); the variant exists so the type names every platform workspace.
"mirror""corpus"
null
updated_atrequired: integerint64
viewer_role: one of
WorkspaceRole
string
Workspace membership role. Ordered low → high (`Member < Admin < Owner`) so that `if actor_role >= WorkspaceRole::Admin` reads naturally.
"member""admin""owner"
null
workspace_idrequired: string

403Forbidden — one of: forbidden, needs_scope

application/json

one of

ErrorForbidden
NeedsScopeError
object
`403` body returned when a classic OAuth token is asked for something its granted scopes do not cover — an explicit private listing without `repo`, or the one-click GitHub mirror without `admin:public_key`. `scope` names the missing grant so the client can say exactly what the token lacks. There is no elevation route to widen it any more (a re-link goes through the GitHub App, whose tokens carry no scopes), so the client's answer is to say so, never to start a handshake.
errorrequired
string
Always `needs_scope` — this body exists to carry the extra fields that kind needs.
"needs_scope"
scoperequired
string
The provider scope to request via elevation (e.g. `"repo"`).

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bad Request — one of: invalid_input
404Not Found — one of: not_found
429Rate limited — retry after the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget