Whoami

Identity a project API key resolves to, for login / status.

Name fields are nullable: they depend on what the internal key-validation contract returns, and the backend never fabricates them. The full API token is never included — only key_hint.

key_scope is the exception to the nullability above, deliberately. A holder asking what their key may do needs an answer, not a maybe: a null would have to be handled by every caller and would mean the same thing the narrow scope already means. It is a closed set of values rather than a free string so a client can exhaust it.