auth

Introspect the caller's identity

Echo back the verified identity resolved from the bearer token: subject, account, workspace hint, scopes, the caller's account role and its advisory permissions, any delegated actor, the token's expiry, and whether this caller has been onboarded.

Standalone extensions call this to reconstruct the caller's identity without verifying the token themselves. The identity fields come from the verified token; role and permissions come from one authorization check against the caller's account: permissions lists the account capabilities the caller holds, and role is admin or member — absent for a human the account roster does not name, and for a machine or delegated caller, which also carries no permissions. permissions is advisory: every route decides its own capability fresh. On a deployment with no billing configured, billing_view and billing_manage are omitted for every role, so a client hides its billing surface when billing_view is absent. The raw token is never returned.

is_onboarded is a database read, not a claim: a caller can hold a valid token and have no personal workspace, and a client needs to tell those apart to know whether to send them through provisioning.

get/registry/v1/auth/whoami

Request

  • Base URL: https://api.atlan.com (the document declares no server; this is the origin it was published from)
  • URL: https://api.atlan.com/registry/v1/auth/whoami
  • Auth: HTTP bearer

Response

The verified caller's resolved identity and onboarding state.

allow_local_syncboolean required

Whether automatic imports of employee-local skills and traces may sync into this account. false in a platform organisation, which takes intentional writes only.

expinteger nullable

Token expiry, unix seconds. Carried so a caller can bound a cache by the token's own lifetime rather than a fixed TTL — a cache hit then cannot outlive the credential.

is_platform_userboolean required

Whether the Control Plane admitted this caller as eligible workforce. Grants no account role and no workspace access.

org_idstring required

Stable identifier of the related org resource.

organisation_type'customer' | 'platform' required

An account's operator-managed classification.

permissionsstring[] required

The account capabilities the caller holds (members_view, billing_manage, …), sorted; empty when the caller has no role. Advisory only — every route decides the capability it needs fresh, never from this list.

rolestring nullable

The caller's account role as the authorization model grants it: admin or member. Absent for a human the account roster does not name, and for a machine, service-account or delegated caller — none holds a human role.

scopesstring[] required

Value of the scopes field.

subjectstring required

The authorization subject — whose authority this request spends, and what every permission check and ownership stamp names.

On a direct call it is the caller. On a delegated one it is the user the agent acts for. It is not the audit actor — read act.subject for who acted.

user_idstring required

The authorization subject's durable id, as a bare string. The same value as subject.

workspacestring required

The token's workspace claim, or empty. A default hint, never a permission.

is_onboardedboolean required

Whether this caller has a personal workspace in this account. false with a valid token means "authenticated but not provisioned here".

Changes

No recorded changes to this operation across all 1 revision of this API.