---
title: "POST /api/rpc/whoAmI"
method: POST
path: "/api/rpc/whoAmI"
tags: ["me"]
---

# POST /api/rpc/whoAmI

`POST /api/rpc/whoAmI`

## Request

- Base URL: `https://21risk.com`
- URL: `https://21risk.com/api/rpc/whoAmI`
- Auth: OAuth 2 (client credentials, token URL `/api/v1/oauth/token`)

Get the authenticated user (name, email, photo) and the tenants they have access to. Call this first to discover the user and their tenants; then use queryTenant with a tenant's slug to load that tenant's boards, permissions, and other scoped details. When called through an OAuth application (e.g. the MCP server), the response includes an `oAuth` object at the root (the acting application, when it was registered, and when the user granted it access) and, on each tenant, an `oAuth` object with that application's read/write access. These application permissions cap what the user can do here: if a tenant's `oAuth.access` is "read" (not "full"), writes to that tenant are rejected even if the user themselves has write permission (they would still be able to write via the 21RISK web app). For a regular web-app session the `oAuth` fields are `null`.

## Response `200`

Successful response

- object
  - `name` string, nullable, required
  - `email` string, required
  - `photo` string, nullable, required
  - `admin21RISK` boolean, required: Whether the user is 21RISK staff.
  - `oAuth` object, nullable, required: The OAuth application acting on the user’s behalf; null for a 21RISK web-app session.
    - `application` object, required
      - `name` string, required
      - `createdAt` string, date-time, required: When the application was registered.
    - `consentIssuedAt` string, date-time, nullable, required: When the user granted the application access.
  - `tenants` object[], required
    - `id` string, required
    - `name` string, required
    - `slug` string, required: Pass as tenantSlug to queryTenant, or as tenant to RPCs.
    - `logo` string, nullable, required
    - `tier` 'enterprise' | 'premium' | 'free', required
    - `frozen` string, date-time, nullable, required: When the organization was frozen; null unless frozen. A frozen organization accepts no edits.
    - `groupOwner` boolean, required
    - `status` 'activeMember' | 'deleted' | 'neverSeen' | 'passiveMember', required
    - `default` boolean, required
    - `oAuth` object, nullable, required
      - `access` 'read' | 'full', required: The application’s access to this tenant; writes need "full".

---

[API](https://skmtc.dev/21risk/apis/21risk-api.md) · [All operations](https://skmtc.dev/21risk/apis/21risk-api/llms.txt) · [OpenAPI document](https://skmtc.dev/21risk/apis/21risk-api/revisions/273a727dfd49?raw)