---
title: "Retrieve the calling credential"
method: GET
path: "/me"
tags: ["Account"]
---

# Retrieve the calling credential

`GET /me`

## Request

- Base URL: `https://api.factuarea.com/v1`
- URL: `https://api.factuarea.com/v1/me`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`

Introspect the authenticating credential: identity, account, environment, rate-limit tier, effective scopes and reachable tax IDs.
- Use it to validate a credential and learn your own opaque tax ID identifier.
- `client_accounts[]` (max 100) is filled only with the privileged `accounts:read` scope; else `client_accounts_visible` is `false`.

## Headers

- `Factuarea-Version` string, date

## Response `200`

- object
  - `data` Me, required: Introspection of the credential authenticating the request: who it is, the account it belongs to, what it can actually do, and which tax IDs it reaches. Use it to validate a credential and discover its scope in a single call. It never carries per-tax-ID settings, nor any pricing, quota or usage field.
    - `object` 'me', required: Stripe-like discriminator. Always `me` for this resource.
    - `account` object, required: The account the credential belongs to. Its opaque identifier is the one that goes in the `{account}` path segment of the account axis.
      - `id` string, required: Opaque identifier of the account (UUID v7). The internal persistence identifier is never published.
      - `name` string, required: Name of the account.
      - `environment` 'live' | 'test', required: Environment of the account (`live` or `test`).
      - `is_provider` boolean, required: Whether the account provisions managed accounts for its clients (it holds the account provider privilege).
      - `privileged_scopes` string[], required: Privileged scopes Factuarea granted to the account. `*` never covers them: a key can only carry them when they are listed here.
    - `api_key` object, required: Metadata of the credential used to authenticate the request. The secret is never returned, neither whole nor in derived form (it is only shown once, at creation or rotation).
      - `id` string, required
      - `name` string, required: Human-friendly label assigned at creation time.
      - `prefix` string, required: First chars of the key (e.g. `fact_live_1N0Fnyhh`) — safe to log.
      - `scopes` string[], required: EFFECTIVE scopes, not the ones requested at issuance: a scope the plan of the scoped tax IDs does not allow is not listed. `*` means super scope (full access).
      - `tier` string, required: Rate-limit tier (`free`, `starter`, `pro`, `scale`). Derived from the plan (or preserved by historical grandfathering).
      - `environment` 'live' | 'test', required: Environment of the authenticated key: `live` (`fact_live_` prefix, real side effects) or `test` (`fact_test_` prefix, sandbox company, no real-world effects). Always matches the real prefix of the credential.
      - `created_at` string, date-time, required
      - `last_used_at` string, date-time, nullable, required
      - `expires_at` string, date-time, nullable, required
    - `scope` object[], required: Tax IDs this credential reaches, each with its opaque identifier and its fiscal identifier. Always enumerated, also when there is exactly one: that is how the holder of a single tax ID discovers its opaque identifier without building it by hand. A company outside the credential scope never appears here, not even one its holder can reach by another route.
      - `id` string, required: Opaque identifier of the company (UUID v7) — the one the company axis expects in the path.
      - `tax_id` string, required: Spanish fiscal identifier (NIF, CIF, NIE). Structural format: NIF `^\d{8}[A-Z]$`, NIE `^[XYZ]\d{7}[A-Z]$`, CIF `^[A-Z]\d{7}[A-Z0-9]$`. AEAT control-digit (checksum) validation is enforced when the request opts in via the `Factuarea-Version` header on or after the activation version; without that opt-in the legacy permissive behaviour is preserved.
      - `name` string, required
    - `client_accounts` object[], required: Accounts of your clients that the credential account reaches through a relation, ordered by `id`: accounts that granted it access (`granted`) and accounts it provisioned and still manages (`provisioned`). Only accounts of the environment of the key are listed, and at most 100 (`client_accounts_has_more` tells whether more exist; list them with `GET /v1/accounts`). Listed ONLY when the credential has the `accounts:read` scope in effect (the same one `GET /v1/accounts` requires): without it the list is empty and `client_accounts_visible` is `false`. Empty as well when there is none.
      - `id` string, required: Opaque identifier of the client account (UUID v7).
      - `name` string, required: Name of the client account.
      - `origin` 'granted' | 'provisioned', required: `granted` when the client account gave your account access; `provisioned` when your account provisioned it and manages it.
      - `access_level` 'none' | 'view' | 'operate', required: Access level of your account on the client account.
      - `status` 'provisioned' | 'claimed' | 'active', required: Status of the client ACCOUNT (not of the relation).
      - `paid_by_provider` boolean, required: Whether your account pays the client account.
      - `environment` 'live' | 'test', required: Environment of the client account.
    - `client_accounts_visible` boolean, required: `true` when the credential has the `accounts:read` scope in effect and `client_accounts` is the real list; `false` when it is empty because that scope is missing.
    - `client_accounts_has_more` boolean, required: `true` when more client accounts exist beyond the 100 listed in `client_accounts`.

## Other responses

- `400`: `parameter_unknown` with `subcode` `retired_active_profile_header`: the retired `X-Active-Profile` header was sent; the company goes in the path. `parameter_invalid_format` on `Factuarea-Version`: the header is not a `YYYY-MM-DD` date. `unsupported_api_version`: the `Factuarea-Version` date is not a supported version.
- `401`: Missing or invalid API key.
- `403`: The request is authenticated but not allowed: the API key lacks the required scope (`insufficient_scope`), the plan does not include the public API or this feature (`addon_not_active`, `feature_not_available_in_plan`), or the module is not available with a test key (`module_not_available_in_sandbox`).
- `429`: Rate limit exceeded. Retry after the duration in `Retry-After`.
- `500`: Unexpected server error.

---

[API](https://skmtc.dev/factuarea/apis/factuarea-public-api.md) · [All operations](https://skmtc.dev/factuarea/apis/factuarea-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/factuarea/apis/factuarea-public-api/revisions/718e77934422?raw)