---
title: "Check the credential"
method: GET
path: "/v1/whoami"
tags: ["Auth"]
---

# Check the credential

`GET /v1/whoami`

## Request

- Base URL: `https://api.rumoro.dev`
- URL: `https://api.rumoro.dev/v1/whoami`
- Auth: HTTP bearer

Call this first. It shows the workspace the credential works in, its type (API key, MCP sign-in token or dashboard session), whether it can write, and for keys the id and expiry. A read key gets 403 read_only_key on any write, and scripts often aim at the wrong workspace.

## Response `200`

Details of the credential

- Whoami
  - `workspace` object, required: The workspace this credential works in.
    - `id` string, required: The workspace's id (org_...).
    - `name` string, required: The workspace's name as shown in the dashboard.
  - `auth` object, required: Details of the credential used.
    - `kind` 'api_key' | 'oauth' | 'session', required: Which credential was used. API key, MCP sign-in token or dashboard session.
    - `scope` 'read' | 'write', required: write can do everything. read is limited to GET.
    - `apiKeyId` string, nullable, required: The API key's id (key_...). Null for other credentials.
    - `expiresAt` string, nullable, required: Expiry of the API key. Null for non-expiring keys, OAuth tokens and sessions.
  - `user` object, nullable, required: The user who signed in, for an OAuth token or a session. Null for an API key, since a key is not tied to a user.
    - `id` string, required: The user's id. Use it for assigneeId and ownerId.
    - `email` string, required: The user's email address.
    - `name` string, nullable, required: The user's name. Null if they have not set one.

## Other responses

- `401`: The API key is missing or not valid

---

[API](https://skmtc.dev/rumoro/apis/rumoro-api.md) · [All operations](https://skmtc.dev/rumoro/apis/rumoro-api/llms.txt) · [OpenAPI document](https://skmtc.dev/rumoro/apis/rumoro-api/revisions/9ef63ea894d1?raw)