---
title: "Identity echo for any credential"
method: GET
path: "/v2/whoami"
tags: ["Identity"]
---

# Identity echo for any credential

`GET /v2/whoami`

## Request

- Base URL: `https://api.infolang.ai`
- URL: `https://api.infolang.ai/v2/whoami`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer
  - HTTP bearer

Workspace-independent answer to "what credential am I holding and what can it touch" (an STS GetCallerIdentity analog). Accepts all three lanes and has no side effects.

On the `key`/`oauth` lanes the identity comes from Kairos's workspace-independent `whoami` op, so `principal` is the credential's real Kairos principal and `workspaces` lists every workspace it may act in — including for a credential holding grants on more than one (previously that case returned an empty list). `principal` may still be null on a Kairos deployment that predates the op, where the gateway falls back to a grant-list lookup that carries no principal id.

`credential.prefix` is the `il_<env>_<key_id>` head of an API key — never secret material, and omitted for the platform-opaque key form, which has no key-id boundary to cut on.

A credential holding no grants at all is a valid identity and reports an empty `workspaces` list rather than failing.

`scoped_namespaces` is the credential's NAMESPACE ceiling — the resource axis below workspace. `null` means unrestricted, which is what every credential minted before namespace scoping reports. A NON-null value changes two things: a request that names no namespace is resolved rather than defaulted (with exactly one entry the gateway injects it; with two or more the request is refused and must name one), and the credential is DENIED on the `/v1/*` and `/mcp` passthrough, which cannot enforce a namespace ceiling.

## Response `200`

The caller's lane, credential and grants

- object
  - `lane` 'session' | 'oauth' | 'key', required
  - `principal` string, nullable, required
  - `credential` object, required
    - `type` 'session_jwt' | 'oauth_token' | 'api_key', required
    - `env` 'live' | 'test'
    - `prefix` string
  - `email` string, email
  - `workspaces` object[], required
    - `workspace_id` string, required
    - `role` 'Owner' | 'Admin' | 'Member' | 'ReadOnly', required
    - `scopes` string[]
  - `scopes` string[], required
  - `scope_source` 'session' | 'key_metadata' | 'legacy_default', required
  - `scoped_workspace_ids` string[], required
  - `scoped_namespaces` string[], nullable, required
  - `expires_at` string, nullable, required
  - `not_before` string, nullable, required

## Other responses

- `401`: Missing/invalid credential
- `502`: Upstream Kairos failure resolving the credential's grants

---

[API](https://skmtc.dev/infolang/apis/infolang-api.md) · [All operations](https://skmtc.dev/infolang/apis/infolang-api/llms.txt) · [OpenAPI document](https://skmtc.dev/infolang/apis/infolang-api/revisions/d04bf6de72c8?raw)