Skip to content
Olivares AI docs

The calling principal and its tenant grants

GET
/v1/auth/whoami
 
curl --request GET \
  --url https://example.com/v1/auth/whoami \
  --header 'Authorization: Bearer <token>'

Returns the calling principal, its tenant grants, and the effective permission set it holds in each of them.

Authorizations

Section titled “ Authorizations ”

Responses

Section titled “ Responses ”

200

Section titled “ 200 ”

OK

Media type application/json
object
aal

Authentication assurance level (sessions only)

integer
actor
required
string
amr

Authentication method references (sessions only)

Array<string>
authentication_configuration

Deployment authentication configuration observed for this response. This is not certificate validation or authorization.

object
piv_configured
required

Whether this deployment has configured PIV verifier roots. Does not indicate certificate presence, OCSP status, or assurance level.

boolean
display_name
string
email

Signed-in user email; omitted for token principals.

string
grants
Array<object>
object
confined_workspace

Present only when this membership is confined to a workspace: the principal may act only within it, enforced server-side on every request.

string
permissions
required

The principal’s EFFECTIVE permission set in this tenant, sorted. The console answers “may I?” by membership of this set. It is the tenant-wide RBAC floor over the permissions this binary serves, minus the workspace-confinement forbids that hold regardless of target; authored scoped grants/forbids and the ABAC deny-overlay are decided per resource and are NOT reflected.

Array<string>
role
required
string
tenant
required
string
tenant_name

The display name of this tenant’s organization, read from the principal’s own tenant (no cross-tenant read). Absent when it cannot be read.

string
kind
required
string
Allowed values: user token
session_ttl_seconds

Session lifetime in seconds at sign-in or refresh (sessions only; fixed by the engine).

integer
superadmin
required
boolean
user_id
required
string format: uuid
Example 
{
  "kind": "user"
}

400

Section titled “ 400 ”

Bad request

Media type application/json
object
error
required
object
code
required
string
message
required
string
module

With code module_not_enabled: the namespace of the module this node does not run.

string
Example generated 
{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

401

Section titled “ 401 ”

Unauthenticated

Media type application/json
object
error
required
object
code
required
string
message
required
string
module

With code module_not_enabled: the namespace of the module this node does not run.

string
Example generated 
{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

403

Section titled “ 403 ”

Forbidden

Media type application/json
object
error
required
object
code
required
string
message
required
string
module

With code module_not_enabled: the namespace of the module this node does not run.

string
Example generated 
{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

404

Section titled “ 404 ”

Not found

Media type application/json
object
error
required
object
code
required
string
message
required
string
module

With code module_not_enabled: the namespace of the module this node does not run.

string
Example generated 
{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

409

Section titled “ 409 ”

Conflict / setup required

Media type application/json
object
error
required
object
code
required
string
message
required
string
module

With code module_not_enabled: the namespace of the module this node does not run.

string
Example generated 
{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

429

Section titled “ 429 ”

Rate limited

Media type application/json
object
error
required
object
code
required
string
message
required
string
module

With code module_not_enabled: the namespace of the module this node does not run.

string
Example generated 
{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}