---
title: "Who am I and where am I working"
method: GET
path: "/api/v1/rest/whoami"
tags: ["Platform"]
---

# Who am I and where am I working

`GET /api/v1/rest/whoami`

## Request

- Base URL: `https://api.custodo.ai`
- URL: `https://api.custodo.ai/api/v1/rest/whoami`
- Auth: HTTP bearer

Returns the acting user, the organisation (tenant) this call resolved to, the modules that organisation has enabled, the commercial tier it holds on each, and the exact set of things this credential may do. CALL THIS FIRST: every other tool is gated on what it reports, so knowing it saves you from guessing which tools exist. Costs nothing and reads no business data.

**Examples**

- What can you do in Custodo?
  `GET /api/v1/rest/whoami`

## Headers

- `X-Tenant-Id` string, uuid

## Response `200`

Done. `data` is the tool’s own answer.

- RestResult
  - `ok` true, required
  - `data` unknown, required

## Other responses

- `400`: The arguments did not validate: `error.message` names the field, what it expects and what arrived.
- `401`: No API key, or one that is malformed, unknown, revoked or expired.
- `403`: The call never ran: the module is off for this organisation, the credential lacks the permission or the module, the tier does not cover it, or the tool is destructive and the key was not minted for that.
- `422`: The tool ran and refused, in a sentence of its own (`TOOL_REFUSED`): the message says what to change. Retrying the same call will not help.
- `429`: The API key has spent its minute, or its day. Every request a key makes counts. See `Retry-After`.

---

[API](https://skmtc.dev/custodo/apis/custodo-integrazioni.md) · [All operations](https://skmtc.dev/custodo/apis/custodo-integrazioni/llms.txt) · [OpenAPI document](https://skmtc.dev/custodo/apis/custodo-integrazioni/revisions/16d336d3ec2a?raw)