Identify the calling principal
whoamiRead-onlyIdempotent
Returns the caller's identity, org, role, role-derived RBAC capabilities, and token scopes. Use this to check whether the current token may perform an action (e.g. config:write) before attempting it.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| role | Yes | ||
| orgId | Yes | ||
| scopes | Yes | ||
| userId | Yes | ||
| projectId | Yes | The project this credential is bound to, or null when it is org-wide. A bound token can read and act only on that project, and on nothing org-wide - so a caller can see the boundary it works within rather than discovering it through a 404. | |
| capabilities | Yes | ||
| principalType | Yes | agent: a self-registered agent nobody has claimed yet. It has no user, org, role or scopes, and reaches only /me and /scopes until a person claims it. |