---
title: "Check what this credential can do"
method: GET
path: "/whoami/grant"
tags: ["Account"]
---

# Check what this credential can do

`GET /whoami/grant`

## Request

- Base URL: `https://api.primitive.dev/v1`
- URL: `https://api.primitive.dev/v1/whoami/grant`
- Auth: HTTP bearer

The grant of the credential that calls it: its permissions, mail scope, resources, template, credential kind and expiry. A credential may call it about itself without any permission, including a narrowed key without account:read, so a key can see its own permissions and mail scope. It answers nothing about any other credential. grant is null when the credential carries no grant.

## Response `200`

Success

- object
  - `success` true, required
  - `data` object, required
    - `org_id` string, required
    - `auth_method` string, nullable, required
    - `key_id` string, nullable, required
    - `grant` object, nullable, required
      - `credential_kind` string, required
      - `template` string, nullable, required
      - `permissions` string[], required
      - `mail_scope` union, required
        - 'org'
        - 'unreadable': unreadable: the stored scope could not be read, so the credential reaches no mail.
        - object
          - `addresses` string[], required
          - `domains` string[], required
          - `direction` 'inbound' | 'outbound' | 'both'
          - `depth` 'metadata' | 'content' | 'raw', required
          - `address_depth` object
          - `domain_depth` object
          - `excluded_personal_mailboxes` integer
      - `send_scope` union
        - 'org'
        - 'unreadable': unreadable: the stored scope could not be read, so the credential reaches no mail.
        - object
          - `addresses` string[], required
          - `domains` string[], required
          - `direction` 'inbound' | 'outbound' | 'both'
          - `depth` 'metadata' | 'content' | 'raw', required
          - `address_depth` object
          - `domain_depth` object
          - `excluded_personal_mailboxes` integer
      - `scoped_permissions` object
      - `resources` object, nullable, required
      - `expires_at` string, nullable, required

## Other responses

- `401`: Invalid or missing API key
- `403`: Authenticated caller lacks permission for the operation
- `429`: Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.

---

[API](https://skmtc.dev/primitive/apis/primitive-api.md) - [All operations](https://skmtc.dev/primitive/apis/primitive-api/llms.txt) - [OpenAPI document](https://skmtc.dev/primitive/apis/primitive-api/revisions/bce409c97acb?raw)