---
title: "The calling key and the company it acts for"
method: GET
path: "/me"
tags: ["Account"]
---

# The calling key and the company it acts for

`GET /me`

## Request

- Base URL: `https://app.fareeqy.com/api/v1`
- URL: `https://app.fareeqy.com/api/v1/me`
- Auth: HTTP bearer

Returns the key itself — its name, its access level and the exact
operations it may call — plus the company it acts for. The canonical
"is my key valid, and what does it reach?" check. `created_by` names the
person who created the key; it is a signature, not the identity the call
runs as. Requires operation `account:read`.

## Response `200`

The authenticated account.

- AccountEnvelope
  - `data` Account: The calling ApiKey and the company it acts for (GET /me).
    - `key` object
      - `name` string: The label the key was given in the app.
      - `access` 'read' | 'write': The scope ceiling. A `write` key also carries `read`.
      - `operations` string[]: Exactly the operations this key may call. Anything else is a 403.
    - `company` object
      - `name` string, nullable
    - `created_by` object: Who created the key. A signature, not the permissions the call runs with.
      - `name` string, nullable
      - `email` string, email, nullable

## Other responses

- `401`: Missing or invalid API key.
- `403`: Two different refusals share this status, and a client must tell them apart by `error.code`. `forbidden` means the key's scope or allowlist does not permit this operation, or Pundit denied the action. `plan_upgrade_required` means the company's plan carries no API access at all, so no key on it can ever succeed and there is nothing to retry.
- `404`: Resource not found or not accessible — also returned for EVERY endpoint when the company's `rest_api` feature flag is disabled (the surface is hidden). Lookups drill through the URL hierarchy, so another company's record is a 404 and never a leak. A path that matches no route at all answers 404 with the distinct code `unknown_endpoint` and echoes the path back, so a mistyped or half-built URL is told apart from a record that is missing or out of reach.
- `429`: Either the company's daily API allowance is spent (`rate_limit_exceeded`), or the per-key / per-IP burst throttle of 300 requests per minute fired. Both come back after a wait, so `Retry-After` is honest here. **The two bodies are not the same shape.** The daily-quota refusal uses the standard error envelope. The burst throttle is served by Rack::Attack ahead of the application, so its body is a flat `{"error": "<string>"}` with no `code`. A client that reads `error.code` has to tolerate `error` being a plain string.

---

[API](https://skmtc.dev/fareeqy/apis/fareeqy-rest-api.md) · [All operations](https://skmtc.dev/fareeqy/apis/fareeqy-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/fareeqy/apis/fareeqy-rest-api/revisions/dc964e05e3d2?raw)