---
title: "Get authenticated principal"
method: GET
path: "/api/v1/me"
tags: ["Auth"]
---

# Get authenticated principal

`GET /api/v1/me`

## Request

- Base URL: `https://app.lastping.dev`
- URL: `https://app.lastping.dev/api/v1/me`
- Auth: API key in header `X-Api-Key`

Returns the authenticated principal's project ID and auth method.
For API-key-authenticated requests only `project_id` and `auth` are
present.  For session-authenticated requests `user_id`, `email`,
`provider`, `theme`, and `console` are also included.

## Response `200`

Authenticated principal details.

- object
  - `project_id` string, uuid, required: Project the credential belongs to.
  - `auth` 'apikey' | 'session', required: `apikey` for API-key requests; `session` for cookie-authenticated requests.
  - `user_id` string, uuid: User ID (session-authenticated only).
  - `email` string, email: Verified email address (session-authenticated only).
  - `provider` string: How the account was created: `local` (email and password), `github` or `google` (session-authenticated only). It records the sign-up, not how the account signs in now: removing that GitHub or Google sign-in later leaves this value unchanged.
  - `theme` 'light' | 'dark': Dashboard colour theme (session-authenticated only).
  - `console` 'templates' | 'spa': Always `spa` since the console cut-over; kept so existing clients do not break. Read-only (session-authenticated only).
  - `last_seen_at` string, date-time, nullable: When this user last called POST /api/v1/me/seen (session-authenticated only). Null until then.
  - `viewing_as` object, nullable: Session-authenticated only. Set while an admin is viewing this account read only (the fields above then describe the account being viewed); null otherwise. Every write made in that state is refused 403 `READ_ONLY_IMPERSONATION`.
    - `email` string, email, required: The account being viewed.
    - `expires_at` string, date-time, required: When the view-as session ends on its own.

## Other responses

- `401`: Missing or invalid credentials.
- `429`: Too many requests. The per-principal fixed-window rate limit has been exceeded. Retry after the number of seconds indicated by the `Retry-After` response header. The problem body's `code` is `RATE_LIMITED`. It names this limiter specifically, so a client can tell it apart from the application-level throttles that also answer 429 with their own codes and their own, much longer, `Retry-After` values (`TEST_PING_RATE_LIMITED`, `TOO_MANY_ATTEMPTS`). Back off globally on `RATE_LIMITED`; back off on the one operation for the others. The principal is the API key for a key-authenticated request and the USER for a browser session, so every tab one person has open shares one budget.
- `503`: Session-authenticated only. An admin's view-as session is active but the viewed account cannot be read (it has no project, or the view-as state could not be looked up), so nothing is served. Code `IMPERSONATION_UNAVAILABLE`. POST /admin/view-as/end still works.

---

[API](https://skmtc.dev/lastping/apis/lastping-management-api.md) · [All operations](https://skmtc.dev/lastping/apis/lastping-management-api/llms.txt) · [OpenAPI document](https://skmtc.dev/lastping/apis/lastping-management-api/revisions/bbc6eda91c46?raw)