Current principal

The authenticated principal, their workspaces with roles, and headline stats (activity events in the last 24h).

On the il_* lanes principal is null — the principal lives inside Kairos and its grant payload carries no id, so the gateway reports null rather than attributing the call to the human who owns the workspace — and workspaces is the CREDENTIAL's reach (its grant set intersected with its workspace ceiling), not everything its owner owns.

Requires the workspace:read scope. Accepts all three lanes: a session JWT (bounded by the caller's role on this workspace) or an il_* machine credential whose own scope set, workspace set and validity window cover it — both ceilings apply and neither can raise the other, so a credential carrying workspace:read is still refused where the role does not permit it.

A credential with no scope record resolves to LEGACY_DEFAULT, which does NOT include workspace:read — mint a key with it explicitly (POST /v2/workspaces/{id}/keys).