I have extended out the Magento API so that I can intercept sales_order.list and not expose all orders to a third party API. This worked fine when only one service was using this API, now there is another 'consumer' of the sales_order.list and I need to differentiate between whom is logged in.

I would prefer to do this the proper Magento way, e.g. to find the API Username of the box accessing sales_order.list, at a push I could check remote IP address but that could change, hence authentication credentials are what I would prefer to check.

I have tried to look at if there is an equivalent of admin/session but could not find anything helpful.

EDIT:

Thanks to @Anna I was able to find a solution for this.

Observer:

public function setPartner(Varien_Event_Observer $observer) {

    $user = $observer->getEvent()->getModel()->getData('username');
    Mage::getSingleton('core/session')->setPartner($user);

}

Then in my extended API code:

$partner = Mage::getSingleton('core/session')->getPartner();
Mage::log($partner);

This now pulls through the 'username' of my API user, so I can therefore block this user from certain things.

Interestingly, in API code land, I could not set a registry value in my observer to then pick up in my extended API code for sales_order.list.

I was stuck for a direction to look in for an answer, @Anna's answer gave me the direction I needed although not a complete solution.