diff --git a/src/modules/auth/auth.controller.ts b/src/modules/auth/auth.controller.ts
index 40eaad9..5eb2b0f 100644
--- a/src/modules/auth/auth.controller.ts
+++ b/src/modules/auth/auth.controller.ts
@@ -37,6 +37,7 @@ import {
   RequireAllPermissions,
 } from 'src/decorators/authentication.decorator';
 import { AuthClientService } from './auth.service';
+import { UserDTO } from './dtos/login';
 import { DadosferaLogger } from '@dadosfera/dadosfera-logs';
 import { GrpcToHttpExceptionFilter } from '../../error/grpc-to-http-exception.filter';
 import { RequestUser, User } from 'src/decorators/user.decorator';
@@ -486,7 +487,7 @@ export class AuthController {
       this.logger.info('Authenticating via X-Api-key header');
       const { api_key } = await this.apiKeyService.get(apiKey);
 
-      const userDto = {
+      const userDto: UserDTO = {
         id: api_key.user_id,
         name: api_key.username,
         email: api_key.username,
@@ -494,7 +495,8 @@ export class AuthController {
           id: api_key.customer_id,
           name: api_key.customer_name,
           tier: api_key.customer_tier,
-        }
+        },
+        permissions: [],
       };
 
       return res.status(200).json(userDto);
diff --git a/src/modules/auth/auth.service.ts b/src/modules/auth/auth.service.ts
index 8539d0e..c82aeef 100644
--- a/src/modules/auth/auth.service.ts
+++ b/src/modules/auth/auth.service.ts
@@ -447,6 +447,9 @@ export class AuthClientService implements OnModuleInit {
         name: payload.customer_name,
         tier: payload.customer_tier,
       },
+      // Raw permission seqids from the JWT. Consumers own the seqid->meaning
+      // mapping (e.g. Orchest's auth-server); Maestro reports them as-is.
+      permissions: payload.permissions ?? [],
     };
 
     return userDto;
diff --git a/src/modules/auth/dtos/login.ts b/src/modules/auth/dtos/login.ts
index 2e22363..1ea22f0 100644
--- a/src/modules/auth/dtos/login.ts
+++ b/src/modules/auth/dtos/login.ts
@@ -152,5 +152,6 @@ export type UserDTO = {
     id: string,
     name: string,
     tier: string,
-  }
+  },
+  permissions: number[],
 }