The calling principal and its tenant grants

GET

/v1/auth/whoami

curl --request GET \
  --url https://example.com/v1/auth/whoami \
  --header 'Authorization: Bearer <token>'

• this engine

Returns the calling principal, its tenant grants, and the effective permission set it holds in each of them.

Authorizations

• bearerAuth

Responses

200

OK

Media type application/json

object

aal

Authentication assurance level (sessions only)

integer

actor

required

string

amr

Authentication method references (sessions only)

Array<string>

display_name

string

grants

Array<object>

object

confined_workspace

Present only when this membership is confined to a workspace: the principal may act only within it, enforced server-side on every request.

string

permissions

required

The principal’s EFFECTIVE permission set in this tenant, sorted. The console answers “may I?” by membership of this set. It is the tenant-wide RBAC floor over the permissions this binary serves, minus the workspace-confinement forbids that hold regardless of target; authored scoped grants/forbids and the ABAC deny-overlay are decided per resource and are NOT reflected.

Array<string>

role

required

string

tenant

required

string

kind

required

string

Allowed values: user token

superadmin

required

boolean

user_id

required

string format: uuid

Example

{
  "kind": "user"
}

400

Bad request

Media type application/json

object

error

required

object

code

required

string

message

required

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

401

Unauthenticated

Media type application/json

object

error

required

object

code

required

string

message

required

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

403

Forbidden

Media type application/json

object

error

required

object

code

required

string

message

required

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

404

Not found

Media type application/json

object

error

required

object

code

required

string

message

required

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

409

Conflict / setup required

Media type application/json

object

error

required

object

code

required

string

message

required

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

429

Rate limited

Media type application/json

object

error

required

object

code

required

string

message

required

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}