curl --request GET \
--url https://{host}/api/v1/auth/me \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://{host}/api/v1/auth/me', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://{host}/api/v1/auth/me"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text){
"all_organisations": true,
"organisation_ids": [
"3c90c3cc-0d44-4b50-8888-8dd25736052a"
],
"team_ids": [
"3c90c3cc-0d44-4b50-8888-8dd25736052a"
],
"user": {
"email": "jsmith@example.com",
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"role": "operator_admin",
"operator_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"organisation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"team_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}{
"error": {
"code": "invalid_request",
"message": "<string>"
}
}Resolved scope for the current token
Returns who the caller is, the organisations, teams and agent identity they resolve to, and every permission their role holds, so the panel can render its navigation without keeping its own copy of the role-to-screen map. Any authenticated caller may call this; there is no permission to hold beyond a valid token. The permission list is a rendering hint only, never a substitute for server-side checks — a client that ignored it entirely would gain nothing. Also reports the daemon’s build and which optional modules it can actually serve, since a module missing from the build cannot be switched on regardless of licence.
curl --request GET \
--url https://{host}/api/v1/auth/me \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://{host}/api/v1/auth/me', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://{host}/api/v1/auth/me"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text){
"all_organisations": true,
"organisation_ids": [
"3c90c3cc-0d44-4b50-8888-8dd25736052a"
],
"team_ids": [
"3c90c3cc-0d44-4b50-8888-8dd25736052a"
],
"user": {
"email": "jsmith@example.com",
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"role": "operator_admin",
"operator_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"organisation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"team_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}{
"error": {
"code": "invalid_request",
"message": "<string>"
}
}Authorizations
Every request sends Authorization: Bearer <token>. The token is either a panel session (a JWT from /auth/login, 12 hours) or an API key ft_<id>_<secret>. An API key is accepted only from an address on its IP allowlist (403 ip_not_allowed otherwise; 403 ip_allowlist_required for an old key that has none), is limited to its rate per minute (429 rate_limited with Retry-After; X-RateLimit-Limit/Remaining/Reset on every response), and at most 60 call placements a minute.