client.identity.me

client.identity.me — the identity.me operations.

On AsyncKindgi every method is the same, awaited.

client.identity.me.second_factor()

second_factor(*, timeout: float | None = None) -> SecondFactorStatus

Signature

My second factor. GET /v1/identity/me/second-factor

Whether you have a second factor set up (an authenticator app), since when, how many recovery codes are left, and whether your workspace requires one. From a session only: 400 auth-not-session-token with an API key. Mounted when the deployment keeps second factors (from 0.1.9).

client.identity.me.start_second_factor()

start_second_factor(
    body: SecondFactorProof | Mapping[str, Any] | None = None,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
    **fields: Any,
) -> SecondFactorKey

Signature

Start setting up a second factor. POST /v1/identity/me/second-factor

A new key for an authenticator app, shown this once: nothing changes until a code from it is confirmed (POST /v1/identity/me/second-factor/confirm), within the hour. With one set up already, a code from it (or a recovery code) is needed, and the new key replaces it at the confirm. From a session only. Mounted when the deployment keeps second factors (from 0.1.9).

client.identity.me.confirm_second_factor()

confirm_second_factor(
    body: SecondFactorConfirmBody | Mapping[str, Any] | None = None,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
    **fields: Any,
) -> SecondFactorRecoveryCodes

Signature

Confirm a new second factor. POST /v1/identity/me/second-factor/confirm

A code from the new key sets it up, and answers the 10 recovery codes, this once. Your sessions stay as they are; your next sign-in asks for a code. From a session only. Mounted when the deployment keeps second factors (from 0.1.9).

client.identity.me.new_recovery_codes()

new_recovery_codes(
    body: SecondFactorProof | Mapping[str, Any] | None = None,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
    **fields: Any,
) -> SecondFactorRecoveryCodes

Signature

New recovery codes. POST /v1/identity/me/second-factor/recovery-codes

10 new recovery codes, shown this once; the old ones stop working. Takes a code from your app, or a recovery code. From a session only. Mounted when the deployment keeps second factors (from 0.1.9).

client.identity.me.remove_second_factor()

remove_second_factor(
    body: SecondFactorProof | Mapping[str, Any] | None = None,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
    **fields: Any,
) -> SecondFactorRemoved

Signature

Take my second factor off. POST /v1/identity/me/second-factor/remove

Off, with a code from your app or a recovery code: the key is deleted and the recovery codes stop working. Refused while your workspace requires one (403 second-factor-required): replace it instead, or ask a tenant admin. From a session only. Mounted when the deployment keeps second factors (from 0.1.9).

client.identity.me.permissions()

permissions(*, timeout: float | None = None) -> MyPermissions

Signature

What I may do. GET /v1/identity/me/permissions

What the caller may do, so a client can hide what it can't: tenant admin, its reviewer role and the roles it decides, its API key's limits and capabilities, the projects it may read with its role in each and every way it holds it (directly, a team, an org it administers, tenant admin), its orgs and teams, and what each project role allows (from the runtime's authorization model). The key's limits are applied: a member key is never tenant admin, and a key limited to a project sees that project alone. Only what the caller may see. The server still checks every call. 501 permissions-unsupported on a runtime without an authorization store: read whoami's tenantAdmin and reviewerRole instead.