---
title: "Describe the calling API key"
method: GET
path: "/v1/whoami"
tags: ["Authentication"]
---

# Describe the calling API key

`GET /v1/whoami`

## Request

- Base URL: `https://api.officina.it`
- URL: `https://api.officina.it/v1/whoami`
- Auth: HTTP bearer

Returns the key making the request: its name, environment and the
scopes it was granted, plus the company it authorises.

Deliberately unscoped — every integrator's first call, and the
cheapest answer to "is my key working". It reveals nothing the
caller does not already hold.

A 200 means the key is valid AND the company's plan includes API
access. 401 means the key is unknown, revoked or expired; 402
means the plan does not include API access.

## Response `200`

The calling key.

- WhoAmI: The API key making the request, as returned by GET /v1/whoami.
  - `object` string, required: always "api_key"
  - `id` string, required
  - `name` string, required: The label the workshop gave the key.
  - `environment` 'live' | 'test', required: Matches the token prefix (ofk_live_ / ofk_test_).
  - `scopes` string[], required: Granted scopes, e.g. "customers.read".
  - `company` object, required
    - `object` string, required: always "company"
    - `id` string, required
    - `name` string, required

## Other responses

- `401`: Missing, malformed, expired, or wrong-audience bearer token.
- `402`: The company has no active subscription, or its plan does not include API access. API access is included in the Business and Illimitato plans.
- `500`: Unhandled server error. Detail is logged, not exposed.

---

[API](https://skmtc.dev/officina/apis/officina-it-api.md) · [All operations](https://skmtc.dev/officina/apis/officina-it-api/llms.txt) · [OpenAPI document](https://skmtc.dev/officina/apis/officina-it-api/revisions/7da3fccfe551?raw)