# Get the current sign-in transaction

`GET /fapi/v1/transactions/current` · called from the environment's sign-in host

Returns the transaction that the `__Host-idp_ltx` cookie points to, including its state and the steps that can run next.
Use it to resume a sign-in page after a reload.

## Request

Headers:

| Header | Required | Description |
| --- | --- | --- |
| `Idp-Client` | yes | SDK identifier, `<package>/<version> (<runtime>/<version>)`. |

The transaction cookie is sent automatically by the browser.

## Response

`200 OK` with the transaction object (`schema_version`, `state`, `next_steps`, `csrf_token`, `expires_at`). Every response
carries `Cache-Control: no-store`.

A transaction that asks the user to link an enterprise connection to an existing account also carries `account_link`
(`connection_name`, `organization_name`); see [Run a sign-in step](/docs/api/fapi/transactions/run-step). The hosted
page reaches it with `resume=1` and continues it instead of creating a new transaction. It does the same after an
enterprise sign-in that still needs a second factor (`second_factor_pending`) or enrollment (`enrollment_pending`).

## DPoP-bound headless transactions

For a transaction started with a `DPoP` header, send a new proof from the same key (`htm` `GET`, `htu` this URL); the
server returns the newest unexpired transaction bound to that key. The authorization code is never returned here.

## Errors

| Status | Code | When |
| --- | --- | --- |
| 400 | `malformed_request` | `Idp-Client` is missing. |
| 410 | `transaction_expired` | There is no cookie, the cookie is invalid, or the transaction has ended. |
| 401 | `invalid_dpop_proof` | The `DPoP` proof is invalid or reused. |

## Example

```bash
curl https://example.keenauth.app/fapi/v1/transactions/current \
  -H "Idp-Client: my-app/1.0.0 (node/22.0.0)" \
  -b cookies.txt
```

## Personal data

This endpoint carries personal data: end-user profile. [Personal data in the KeenAuth APIs](/docs/policies/personal-data) describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.