I have extended out the Magento API so that I can intercept sales_order.list and not expose all orders to a third party API. This worked fine when only one service was using this API, now there is another 'consumer' of the sales_order.list and I need to differentiate between whom is logged in.

I would prefer to do this the proper Magento way, e.g. to find the API Username of the box accessing sales_order.list, at a push I could check remote IP address but that could change, hence authentication credentials are what I would prefer to check.

I have tried to look at if there is an equivalent of admin/session but could not find anything helpful.