---
title: Get the calling credential
description: "Describes the credential behind the bearer token: what kind of
  principal it is, the scopes it carries, and the organizations it can reach."
type: api-reference
source: ./openapi/inth-api.json
method: get
path: /v1/me
operationId: getMe
server: https://api.inth.com
apiVersion: 1.0.0
tags:
  - System
canonicalUrl: https://inth.com/docs/api/rest-api/system/get-me
lastModified: "2026-09-08T10:41:29.401Z"
---
```http
GET /v1/me
```

Server: `https://api.inth.com`

Operation ID: `getMe`

## Authentication

* bearerAuth

### Schemes

* bearerAuth: http / bearer - Use an Inth API key or OAuth access token in the Authorization header.

  Every operation needs a capability. An OAuth access token carries the capabilities it was granted as scopes; an organization API key carries a fixed set (\`organizations.read\`, \`projects.read\`, \`projects.write\`, \`api-keys.read\`, \`inbox.read\`, \`billing.read\`). A credential without the capability an operation needs is answered with \`403 INSUFFICIENT\_SCOPE\`. \`GET /v1/me\` reports the capabilities of the calling credential.

  OAuth scopes:
  - \`organizations.read\`: List the organizations you belong to.
  - \`organizations.write\`: Create organizations you will own.
  - \`projects.read\`: Read projects and their consent configuration.
  - \`projects.write\`: Create, update, and delete projects and their consent configuration.
  - \`members.read\`: Read member names, email addresses, profile images, roles, and pending invitation email addresses.
  - \`members.write\`: Invite members, change member roles, remove members, and cancel invitations.
  - \`api-keys.read\`: List organization API keys.
  - \`api-keys.write\`: Create, roll, and delete organization API keys.
  - \`code-audit.read\`: Read Code Audit scans, their findings, and connected repositories.
  - \`code-audit.write\`: Start Code Audit scans and unlock their reports.
  - \`inbox.read\`: Read Inbox findings.
  - \`inbox.write\`: Change the status of Inbox findings and open GitHub issues for them.
  - \`billing.read\`: Read the plan and credit balance of an organization.

## Code Examples

### cURL

```bash
curl -X GET "https://api.inth.com/v1/me" \
  -H "Authorization: Bearer <token>"
```

### JavaScript

```ts
const response = await fetch("https://api.inth.com/v1/me", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <token>"
  },
});
const data = await response.json();
```

## Responses

### 200

The calling credential and its organizations.

Content type: application/json

|Property|Type|Required|Description|
|:--|:--|:--|:--|
|`success`|boolean|required||
|`data`|object|required||
|`data.principal`|object|required||
|`data.principal.type`|"session" \|"api\_key" \|"oauth"|required||
|`data.principal.userId`|string|optional|Present for session and oauth principals. API keys are organization credentials and carry no acting user.|
|`data.principal.keyId`|string|optional||
|`data.principal.organizationId`|string|optional|The organization the API key belongs to (api\_key principals only).|
|`data.principal.createdBy`|string|optional|User who minted the API key. Attribution only, never authorization.|
|`data.principal.activeOrganizationId`|string \|null|optional||
|`data.activeOrganizationId`|string \|null|required||
|`data.scopes`|"organizations.read" \|"organizations.write" \|"projects.read" \|"projects.write" \|"members.read" \|"members.write" \|"api-keys.read" \|"api-keys.write" \|"code-audit.read" \|"code-audit.write" \|"inbox.read" \|"inbox.write" \|"billing.read"\[]|required|What the calling credential may do, sorted. Derived from the granted OAuth scopes for oauth principals; organization API keys carry a fixed set.|
|`data.organizations`|object\[]|required|Organizations the credential can reach. Empty when organizations.read was not granted.|
|`data.organizations[].id`|string|required||
|`data.organizations[].slug`|string|required||
|`data.organizations[].name`|string|required||
|`data.organizations[].role`|"owner" \|"admin" \|"member"|required|The role of the calling credential in this organization.|

Example: default

```json
{
  "success": true,
  "data": {
    "principal": {
      "type": "api_key",
      "keyId": "key_123",
      "organizationId": "org_123",
      "createdBy": "usr_123"
    },
    "activeOrganizationId": "org_123",
    "scopes": [
      "api-keys.read",
      "organizations.read",
      "projects.read",
      "projects.write"
    ],
    "organizations": [
      {
        "id": "org_123",
        "slug": "acme",
        "name": "Acme",
        "role": "owner"
      }
    ]
  }
}
```

JSON Schema:

```json
{
  "type": "object",
  "required": [
    "success",
    "data"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": true
    },
    "data": {
      "type": "object",
      "required": [
        "principal",
        "activeOrganizationId",
        "scopes",
        "organizations"
      ],
      "properties": {
        "principal": {
          "type": "object",
          "required": [
            "type"
          ],
          "properties": {
            "type": {
              "type": "string",
              "enum": [
                "session",
                "api_key",
                "oauth"
              ]
            },
            "userId": {
              "type": "string",
              "description": "Present for session and oauth principals. API keys are organization credentials and carry no acting user."
            },
            "keyId": {
              "type": "string"
            },
            "organizationId": {
              "type": "string",
              "description": "The organization the API key belongs to (api_key principals only)."
            },
            "createdBy": {
              "type": "string",
              "description": "User who minted the API key. Attribution only, never authorization."
            },
            "activeOrganizationId": {
              "oneOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ]
            }
          }
        },
        "activeOrganizationId": {
          "oneOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ]
        },
        "scopes": {
          "type": "array",
          "items": {
            "type": "string",
            "enum": [
              "organizations.read",
              "organizations.write",
              "projects.read",
              "projects.write",
              "members.read",
              "members.write",
              "api-keys.read",
              "api-keys.write",
              "code-audit.read",
              "code-audit.write",
              "inbox.read",
              "inbox.write",
              "billing.read"
            ],
            "description": "Something a credential is allowed to do. Scope names double as OAuth scope strings.\n- `organizations.read`: List the organizations you belong to.\n- `organizations.write`: Create organizations you will own.\n- `projects.read`: Read projects and their consent configuration.\n- `projects.write`: Create, update, and delete projects and their consent configuration.\n- `members.read`: Read member names, email addresses, profile images, roles, and pending invitation email addresses.\n- `members.write`: Invite members, change member roles, remove members, and cancel invitations.\n- `api-keys.read`: List organization API keys.\n- `api-keys.write`: Create, roll, and delete organization API keys.\n- `code-audit.read`: Read Code Audit scans, their findings, and connected repositories.\n- `code-audit.write`: Start Code Audit scans and unlock their reports.\n- `inbox.read`: Read Inbox findings.\n- `inbox.write`: Change the status of Inbox findings and open GitHub issues for them.\n- `billing.read`: Read the plan and credit balance of an organization."
          },
          "description": "What the calling credential may do, sorted. Derived from the granted OAuth scopes for oauth principals; organization API keys carry a fixed set."
        },
        "organizations": {
          "type": "array",
          "items": {
            "type": "object",
            "required": [
              "id",
              "slug",
              "name",
              "role"
            ],
            "properties": {
              "id": {
                "type": "string"
              },
              "slug": {
                "type": "string"
              },
              "name": {
                "type": "string"
              },
              "role": {
                "type": "string",
                "enum": [
                  "owner",
                  "admin",
                  "member"
                ],
                "description": "The role of the calling credential in this organization."
              }
            }
          },
          "description": "Organizations the credential can reach. Empty when organizations.read was not granted."
        }
      }
    }
  }
}
```

### 401

Authentication is missing, invalid, or expired.

Content type: application/json

|Property|Type|Required|Description|
|:--|:--|:--|:--|
|`success`|boolean|required||
|`error`|object|required||
|`error.code`|"UNAUTHORIZED" \|"FORBIDDEN" \|"INSUFFICIENT\_SCOPE" \|"PLAN\_LIMIT\_REACHED" \|"PLAN\_REQUIRED" \|"INVALID\_ORIGIN" \|"INVALID\_REGION" \|"INVALID\_PAYLOAD" \|"NOT\_FOUND" \|"CONFLICT" \|"KEY\_LIMIT\_REACHED" \|"INSUFFICIENT\_CREDITS" \|"SCAN\_IN\_PROGRESS" \|"UNLOCK\_REQUIRED" \|"REPOSITORY\_NOT\_LINKED" \|"PAYLOAD\_TOO\_LARGE" \|"RATE\_LIMITED" \|"SERVICE\_UNAVAILABLE" \|"INTERNAL\_ERROR"|required||
|`error.message`|string|required||
|`error.details`|unknown|optional|Optional structured error details.|

Example: default

```json
{
  "success": false,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Authentication required"
  }
}
```

JSON Schema:

```json
{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}
```

### 403

The credential is valid but may not perform the operation.

\`INSUFFICIENT\_SCOPE\`: the credential was never granted the capability the operation needs. \`details.requiredScope\` names it, and the \`WWW-Authenticate\` header carries \`Bearer error="insufficient\_scope"\`. An OAuth client fixes this by requesting the scope; an organization API key cannot gain it.

\`FORBIDDEN\`: the capability is present but the membership behind the credential lacks the role, or the resource belongs to another organization.

Content type: application/json

|Property|Type|Required|Description|
|:--|:--|:--|:--|
|`success`|boolean|required||
|`error`|object|required||
|`error.code`|"UNAUTHORIZED" \|"FORBIDDEN" \|"INSUFFICIENT\_SCOPE" \|"PLAN\_LIMIT\_REACHED" \|"PLAN\_REQUIRED" \|"INVALID\_ORIGIN" \|"INVALID\_REGION" \|"INVALID\_PAYLOAD" \|"NOT\_FOUND" \|"CONFLICT" \|"KEY\_LIMIT\_REACHED" \|"INSUFFICIENT\_CREDITS" \|"SCAN\_IN\_PROGRESS" \|"UNLOCK\_REQUIRED" \|"REPOSITORY\_NOT\_LINKED" \|"PAYLOAD\_TOO\_LARGE" \|"RATE\_LIMITED" \|"SERVICE\_UNAVAILABLE" \|"INTERNAL\_ERROR"|required||
|`error.message`|string|required||
|`error.details`|unknown|optional|Optional structured error details.|

Example: insufficientScope

```json
{
  "success": false,
  "error": {
    "code": "INSUFFICIENT_SCOPE",
    "message": "This token was not granted the projects.write scope",
    "details": {
      "requiredScope": "projects.write"
    }
  }
}
```

Example: forbidden

```json
{
  "success": false,
  "error": {
    "code": "FORBIDDEN",
    "message": "Organization membership is required"
  }
}
```

JSON Schema:

```json
{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}
```

#### Headers

|Name|Type|Required|Description|
|:--|:--|:--|:--|
|`WWW-Authenticate`|string|optional|Present on \`INSUFFICIENT\_SCOPE\`: \`Bearer error="insufficient\_scope", scope="\<required scope>"\`.|

### 500

An unexpected internal error occurred.

Content type: application/json

|Property|Type|Required|Description|
|:--|:--|:--|:--|
|`success`|boolean|required||
|`error`|object|required||
|`error.code`|"UNAUTHORIZED" \|"FORBIDDEN" \|"INSUFFICIENT\_SCOPE" \|"PLAN\_LIMIT\_REACHED" \|"PLAN\_REQUIRED" \|"INVALID\_ORIGIN" \|"INVALID\_REGION" \|"INVALID\_PAYLOAD" \|"NOT\_FOUND" \|"CONFLICT" \|"KEY\_LIMIT\_REACHED" \|"INSUFFICIENT\_CREDITS" \|"SCAN\_IN\_PROGRESS" \|"UNLOCK\_REQUIRED" \|"REPOSITORY\_NOT\_LINKED" \|"PAYLOAD\_TOO\_LARGE" \|"RATE\_LIMITED" \|"SERVICE\_UNAVAILABLE" \|"INTERNAL\_ERROR"|required||
|`error.message`|string|required||
|`error.details`|unknown|optional|Optional structured error details.|

Example: default

```json
{
  "success": false,
  "error": {
    "code": "INTERNAL_ERROR",
    "message": "Internal server error"
  }
}
```

JSON Schema:

```json
{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}
```

## Related

* [REST API overview](/docs/api/rest-api): Every operation in this API.