# Fetch the caller's tenant

GET

/v1/tenant

```sh
curl --request GET \
  --url https://example.com/v1/tenant \
  --header 'Authorization: Bearer <token>'
```

Returns the tenant the bearer token authenticates as. There is no `/v1/tenants` collection — tenants are the sovereignty boundary, not a listable resource under a tenant. A runtime that gates production adds `productionAllowed` (and `productionNext` while it’s `false`), one that sets limits adds the tenant’s `limits`, and a deployment that publishes where its calls come from adds `egress`.

## Authorizations

- **[bearerAuth](https://docs.kindgi.com/v0.1.9/reference/api.md#bearerauth)**

## Responses

### 200

Tenant.

application/json

object

**id**

required

string format: uuid

**name**

required

string

**slug**

required

string

**createdAt**

required

string format: date-time

**updatedAt**

required

string format: date-time

**productionAllowed**

Whether the tenant may put projects in production. Absent from a runtime that doesn’t gate production.

boolean

**productionNext**

Where to go to be allowed to put projects in production, for example a billing page. Only while `productionAllowed` is `false`, and only when the runtime names one.

string

**state**

On a runtime serving many tenants: `closing` (readable and exportable for its window, nothing changes) or `suspended` (the same, until restored). `closing` wins. Absent: active.

string

Allowed values: active suspended closing

**limits**

The tenant’s limits that are set. A limit that isn’t set is absent, and isn’t enforced.

object

**apiRequestsPerMinute**

API requests a minute. Past it: 429 `rate-limit-exceeded`.

integer

\>= 1

**webhookReceivesPerMinute**

Webhook deliveries received a minute, across the tenant’s triggers. Past it: 429.

integer

\>= 1

**runsAtOnce**

Runs executing at once. Past it, a new run waits as `pending`.

integer

\>= 1

**runsPending**

Runs waiting as `pending`. Past it, a new run is refused with 429.

integer

\>= 1

**toolCallsInFlight**

Tool calls in flight to the tenant’s pack services. Past it, a call waits for a slot.

integer

\>= 1

**approvalsPending**

Approvals waiting for a decision. Past it, the step that asks fails, naming the limit.

integer

\>= 1

**projectsInProduction**

Projects in production at once. Past it, putting another project in production is refused with 403 `production-limit-reached`. Lowering it takes no project out of production.

integer

\>= 1

**egress**

The IP addresses this deployment’s calls to other sites come from, for a site that admits only known addresses. They’re the same for every tenant on the deployment, so admitting them admits every tenant’s calls: a site still checks its own credentials. They say where calls come from, not where they go. Absent when the deployment publishes none. An empty list: none of that kind.

object

**server**

required

Where the server’s own calls come from, such as its calls to MCP servers and model providers, and its webhook deliveries.

Array\<string>

**deployments**

required

Where calls made by the code deployed to it come from.

Array\<string>

##### Example

```json
{
  "state": "active"
}
```

### 401

Missing / malformed / expired / revoked bearer token.

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

### 404

The tenant id on the token does not resolve to a stored row.

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

## See also

- [Publish the addresses your calls come from](https://docs.kindgi.com/v0.1.9/deploy/self-hosted/egress-addresses.md)
- [Serve many tenants](https://docs.kindgi.com/v0.1.9/deploy/self-hosted/serve-many-tenants.md)
- [Organize work by org and project](https://docs.kindgi.com/v0.1.9/guides/projects/organize-by-org-and-project.md)
- [Every error code](https://docs.kindgi.com/v0.1.9/reference/errors.md)