---
title: "Read your profile, limits and grants"
method: GET
path: "/api/account/"
tags: ["Activity and account"]
---

# Read your profile, limits and grants

`GET /api/account/`

## Request

- Base URL: `https://eyalsec.com`
- URL: `https://eyalsec.com/api/account/`
- Auth: one of:
  - API key in header `X-API-Key`
  - API key in cookie `__Host-es2session`

Returns what the Settings page shows: your username, recovery email, timezone, which second factors are on, your machine and event limits, and whether raise rules are enabled for you. It never returns your password hash, your TOTP secret, an API key or a machine secret.

This is a **read**: a read-only API key may call it.

## Response `200`

OK.

- object

## Other responses

- `401`: The API key is missing, wrong, revoked or expired.
- `429`: A rate limit was hit, or the account is locked after wrong passwords. Retry-After gives the seconds to wait.
- `default`: An error. Check the status first; the body carries a short message, as JSON ({"error": "..."}) on most endpoints and as plain text on some. 400: malformed JSON, an invalid regex, an unreadable cursor or date, or an unknown value. 401: the API key is missing, wrong, revoked or expired. 403: a failed CSRF check, a read-only key trying to write, a product or feature not enabled on your account, a wrong password, or a write on an account limited to reading. 404: not found, including things that belong to another account. 409: conflict with the current state. 422: a field is missing or invalid. 429: a rate limit was hit, or the account is locked after wrong passwords. 500: something failed on our side.

---

[API](https://skmtc.dev/eyalsec/apis/eyalsec-api.md) · [All operations](https://skmtc.dev/eyalsec/apis/eyalsec-api/llms.txt) · [OpenAPI document](https://skmtc.dev/eyalsec/apis/eyalsec-api/revisions/dc7520689cf1?raw)