client.identity.me

client.identity.me — the identity.me operations.

On AsyncKindgi every method is the same, awaited.

client.identity.me.permissions()

permissions(*, timeout: float | None = None) -> MyPermissions

What I may do. GET /v1/identity/me/permissions

What the caller may do, so a client can hide what it can't: tenant admin, its reviewer role and the roles it decides, its API key's limits and capabilities, the projects it may read with its role in each and every way it holds it (directly, a team, an org it administers, tenant admin), its orgs and teams, and what each project role allows (from the runtime's authorization model). The key's limits are applied: a member key is never tenant admin, and a key limited to a project sees that project alone. Only what the caller may see. The server still checks every call. 501 permissions-unsupported on a runtime without an authorization store: read whoami's tenantAdmin and reviewerRole instead.