Identify the calling API key

Returns the organization the key belongs to and the scopes it holds.

Requires authentication but no scope, so a client can verify a key without being granted read access to a resource it does not otherwise need.