Validate the supplied Passport bearer token and restores the SPA session: returns the authenticated user, their company, theme, white-label and (for account companies) plan context. Mirrors the login payload minus the freshly-minted token (it echoes the bearer token from the request).

Auth: Both — authentication (Passport bearer). Target is always the authenticated user; no partner/account-tree scoping. The returned the account's bundle_id reflects whichever role's token was supplied.

Rate limit: No rate limit.

Request

• Header: Authorization: Bearer <bearer-token> (required).
• No path params, query params, or body.

Response — { data. } envelope.

• token (string) — the same bearer token you sent, echoed back
• user (object) — id, username, email, inactive_at (nullable), email_verified_at, phone_number, first_name, last_name, title, role (or "User"), total_location
• company (object) — id, name, bundle_id, plus appended enable_insight_report (0/1), enable_competitive_analysis (0/1), dormant_accounts_enabled (0/1), and company_option (company_id, who_will_pay, enable_generic_alert, enable_insight_report, enable_competitive_analysis)
• theme_options (string) — JSON string
• white_label (object) — logo, white_url, favicon, title, status, login_logo, company_id, email_templates_enabled
• plan (object|null) — only when company.bundle_id == 3; same plan+features shape as login. Null otherwise.

401 "Unauthenticated." if the token is missing/invalid.