---
title: "Get the authenticated user and workspace"
method: GET
path: "/v1/auth/whoami"
tags: ["Auth"]
---

# Get the authenticated user and workspace

`GET /v1/auth/whoami`

Returns the authenticated user and (when present) workspace from the auth context, plus the calling credential's own scopes. Requires an authenticated user but NOT a workspace — `workspace` is omitted when the caller has none.

## Response `200`

The caller's identity

- WhoamiResponse
  - `user` AuthUser, required
    - `userId` string, required — Clerk user id.
    - `username` string, required — Username from Clerk (may be empty).
    - `email` string — Primary email, when known.
    - `metadata` object, required — Free-form user metadata record.
    - `createdAt` string, date-time, required — Record creation time (ISO-8601).
    - `updatedAt` string, date-time, required — Record last-update time (ISO-8601).
  - `workspace` AuthWorkspace — Absent when the caller is not part of a workspace.
    - `workspaceId` string, required — Workspace (Clerk organization) id.
    - `name` string, required — Organization display name (may be empty).
    - `slug` string, required — Organization slug (may be empty).
    - `metadata` object, required — Free-form workspace metadata record.
    - `createdAt` string, date-time, required — Record creation time (ISO-8601).
    - `updatedAt` string, date-time, required — Record last-update time (ISO-8601).
  - `credential` AuthCredential, required
    - `kind` 'clerk_session' | 'api_key', required — How the request was authenticated.
    - `scopes` string[], required — The grants this credential holds (`*` = everything) — also the MOST a key it mints may hold.
    - `defaultScopes` string[], required — What `POST /v1/api-keys` mints when this credential omits `scopes`: a session gets every resource except `controls`; an API key passes its own grants down. See `GET /v1/api-keys/scopes` for the catalog.
    - `fingerprint` string — API-key fingerprint (= AEP `credential_id`). Absent for sessions.
    - `expiresAt` string, date-time — API-key expiry. Absent when it never expires or for sessions.
  - `identities` IdentitySummary[], required — External identities linked to this user (e.g. a World ID). The Clerk login itself is not listed.
    - `provider` 'clerk' | 'aep' | 'world' | 'world-sandbox', required
    - `verified` boolean, required — Whether the provider vouched for this identity.
    - `linkedAt` string, date-time, required
    - `lastVerifiedAt` string, date-time — Last successful (re-)verification, for OIDC identities.
  - `identityProviders` IdentityProviderAvailability[], required — Linkable providers and whether linking is enabled.
    - `key` 'clerk' | 'aep' | 'world' | 'world-sandbox', required
    - `enabled` boolean, required — Whether NEW links can be started for this provider.

## Other responses

- `401` — Unauthorized — missing or invalid credentials
- `403` — Forbidden — caller has no workspace or no access
- `500` — Internal server error

## Changes

- **2026-09-25** `5abada71ceae` — 39 warning, 3 info
  - added the new `IDENTITY_ALREADY_LINKED` enum value to the `errorCode` response property for the response status `401`
  - added the new `IDENTITY_ALREADY_LINKED` enum value to the `errorCode` response property for the response status `403`
  - added the new `IDENTITY_ALREADY_LINKED` enum value to the `errorCode` response property for the response status `500`
  - added the new `IDENTITY_LINK_RATE_LIMITED` enum value to the `errorCode` response property for the response status `401`
  - …38 more
- **2026-09-23** `fadab791136c` — 3 warning
  - added the new `X402_UNBOUNDED_PRICE` enum value to the `errorCode` response property for the response status `401`
  - added the new `X402_UNBOUNDED_PRICE` enum value to the `errorCode` response property for the response status `403`
  - added the new `X402_UNBOUNDED_PRICE` enum value to the `errorCode` response property for the response status `500`
- **2026-09-11** `9874d9e34fcf` — 3 info
  - added the optional property `errorCode` to the response with the `401` status
  - added the optional property `errorCode` to the response with the `403` status
  - added the optional property `errorCode` to the response with the `500` status

[Change history](https://skmtc.dev/monid/apis/monid-api/changes/v1/auth/whoami/get.md)

---

[API](https://skmtc.dev/monid/apis/monid-api.md) · [All operations](https://skmtc.dev/monid/apis/monid-api/llms.txt) · [OpenAPI document](https://skmtc.dev/monid/apis/monid-api/revisions/5abada71ceae?raw)