Skip to content
Kindgi

Self — the caller's user + tenant + session context

View as Markdown
GET
/v1/identity/whoami
curl --request GET \
  --url https://example.com/v1/identity/whoami \
  --header 'Authorization: Bearer <token>'

Reflects the auth middleware’s attached context: tenantId + scopes always; userId / sessionId / providerId / expiresAt when the caller is on a session token; the fuller UserRecord under user when a userId is present and the IdentityDirectoryBinding resolves it. Always mounted — the /users/* routes only mount when the directory binding is wired.

Authorizations

Section titled “Authorizations”

Responses

Section titled “Responses”

200

Section titled “200”

Auth + user context.

Media typeapplication/json

Introspection of the caller’s current authentication context. Always carries tenantId and scopes (empty for static bearer tokens), plus userId when the token carries one; principal says whom the caller acts as, and an API key adds tokenId, its role and the projectId it is limited to; session-token callers additionally see sessionId, providerId, and expiresAt. user is the caller’s directory record, present when the deployment wires an identity directory and it knows the userId. reviewerRole is set when the caller is a reviewer — its token carries a reviewer role, or its user is a registered reviewer — so clients can gate reviewer-only UI (the approvals surface) without a second round trip.

object
tenantId
required
string format: uuid
actor

The caller as approvals name a person: user:<id> or service_account:<id>, the same string as an approval’s requestedBy and a decision’s decidedBy.

string
userId
string
sessionId
string
providerId
string
scopes
required
Array<string>
expiresAt
string format: date-time
reviewerRole

Reviewer role class. Hierarchy: standard < senior < admin.

string
Allowed values: standard senior admin
user

Tenant-scoped user record (admin plane). primaryEmail may be redacted on the wire based on tenant policy (the routes treat it as opaque). metadata is free-form JSON — deployments carry IdP claims / provisioning source / roles here.

object
userId
required
string
tenantId
required
string format: uuid
primaryEmail
string
displayName
string
createdAt
required
string format: date-time
lastActiveAt
string format: date-time
unregisteredAt

When they were removed from the tenant (POST /v1/identity/users/{userId}/unregister); absent while they are here.

string format: date-time
metadata
object
key
additional properties
any
grants

The person’s grants: only on GET /v1/identity/users?include=grants, and only from a runtime that reads grants.

object
userId
required
string
tenantAdmin

Whether the person is a tenant admin. Absent when the runtime has no authorization store: nothing grants it then.

boolean
tenantMember

Whether the person is a tenant member: they read the tenant’s settings (providers, policies, adapters, signing keys, deployments), not its projects. A person is one from being added. Absent when the runtime has no authorization store, or doesn’t report it.

boolean
projects
required

Direct project memberships.

Array<object>

A person’s direct role on a project.

object
projectId
required
string
role
required

Role on a project, as read. member is only read, on a role given before it was retired: it grants what viewer does, and writes refuse it.

string
Allowed values: viewer editor owner admin member
teams
required

Team memberships.

Array<object>

A person’s role in a team.

object
teamId
required
string
role
required

Role on a team membership.

string
Allowed values: member admin
reviewer

A person’s active entry on the reviewer roster.

object
role
required

Reviewer role class. Hierarchy: standard < senior < admin.

string
Allowed values: standard senior admin
principal

Whom an API key acts for: a person, or a service account.

object
kind
required
string
Allowed values: user service-account
id
required

The user id, or the service account id.

string
>= 1 characters
tokenId

The caller’s API key, when it is one.

string
role

The caller’s API key role, when the key has one.

string
Allowed values: admin member
projectId

The project the caller’s API key is limited to, when it is.

string
tenantAdmin

Whether the caller is a tenant admin, decided as the admin routes decide it: admin on the tenant when the runtime authorizes, otherwise the tenant-admin scope of a full key (never a member key or one limited to a project). A console shows its admin pages by it. Absent from older servers: read scopes.

boolean
Example
{
  "reviewerRole": "standard",
  "user": {
    "grants": {
      "projects": [
        {
          "role": "viewer"
        }
      ],
      "teams": [
        {
          "role": "member"
        }
      ],
      "reviewer": {
        "role": "standard"
      }
    }
  },
  "principal": {
    "kind": "user"
  },
  "role": "admin"
}

401

Section titled “401”

Missing / malformed / expired / revoked bearer token.

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

See also