# Account Who the session belongs to. Read the current member, their organization and permissions. Every product endpoint under `/api/v1` reads the session cookie and resolves it into a principal: the organization, the membership, and the permissions its roles grant. This endpoint returns that principal, along with the person and organization behind it. ## Retrieve the current member `GET /api/v1/me` Auth: Reviewer session cookie (`withhuman_session`) or personal API key (`Authorization: Bearer $WITHHUMAN_API_KEY`) Self-service: acts on the caller's own account, no permission needed. Returns who the session belongs to. The `principal` is what the API checks permissions against on every call. The rest is for display: the person's name and email, the organization, and the role assignments the membership holds. Call this after signing in to learn what the session can do. ### Request No parameters or body. ### Response | Status | Body | Description | | --- | --- | --- | | 200 | object | The member behind the session | | 401 | | No session cookie, or the session has expired or been signed out | Response body (200): - `principal` · Principal · required: The identity the API checks permissions against. A person acting through a session, or a machine acting through a credential. - `actor_type` · enum · required: `human` for a signed-in person, `agent` for an agent credential, `gateway` for the chokepoint MCP gateway acting for the organization with the deployment's gateway token, `system` for actions the provider takes on its own. One of `human`, `agent`, `system`, `gateway`. - `actor_id` · uuid · required: The user's id for a person, an internal id for an agent (address agents by `agent_slug`), or the literal `gateway` for the gateway. - `organization_id` · uuid · required: The organization every call is scoped to. - `membership_id` · uuid: The person's membership in the organization. Present for a person only. - `agent_instance_id` · uuid: The instance the credential belongs to. Present for an agent only. - `agent_slug` · string: The agent's slug. Present for an agent only. - `permissions` · array · required: Every permission the actor holds at any scope, such as `request.decide`, sorted and without duplicates. Use it to decide what to show. Whether an action is allowed depends on `grants`. - `grants` · array · required: Every permission the actor holds, each with the scope it applies at. Flattened from the role assignments. - `permission` · string · required: A registry key such as request.decide - `scope_kind` · enum · required One of `organization`, `team`, `agent`. - `scope_id` · string: The team id or agent slug the grant applies to; absent at organization scope - `team_ids` · array: The teams the member belongs to. Escalation paths can route requests to a team. - `auth` · AuthContext · required: How a principal was signed in when it acted. - `method` · string · required: How the principal signed in, for example `local_password`, `sso`, or `social_google`. - `assurance` · string · required: The strength of that sign-in: `single_factor` or `strong`. - `authenticated_at` · date-time · required: When the sign-in happened. - `session_id` · uuid: The session that acted, when a person did. - `credential_id` · uuid: The credential that acted, when an agent did. - `user` · object: The person who signed in. - `display_name` · string: The name shown in the product. - `email` · string: The primary email address on the account. - `has_password` · boolean: Whether the account has a password. False for an account that only signs in through an identity provider; such an account cannot change or reset a password. - `organization` · object: The organization the session is scoped to. - `name` · string: The organization's display name. - `slug` · string: The organization's URL-safe identifier. - `assignments` · array: The membership's role assignments: its own, plus the ones it inherits through its teams. The `grants` in the principal are flattened from these. - `id` · uuid · required - `organization_id` · uuid · required - `principal_kind` · enum · required: What holds the role. One of `membership`, `team`, `agent`. - `principal_id` · uuid · required: The membership, team or agent that holds it. - `scope_kind` · enum · required: Where the role applies. One of `organization`, `team`, `agent`. - `scope_id` · string: The team id or the agent slug. Absent for `organization`. - `scope_name` · string: The team's name, for a team scope. - `source` · enum · required: Whether a person granted it or your directory did. One of `manual`, `directory`. - `source_key` · string: The directory group that produced it. Present for `directory` only. - `granted_by_actor_id` · uuid: The member who granted it. Present for `manual` only. - `via_team_id` · uuid: The team the role is inherited through. Present when a member holds it through a team rather than directly. - `via_team_name` · string: That team's name. - `created_at` · date-time · required - `permissions` · array · required - `is_owner` · boolean · required - `permission_policy_id` · uuid - `onboarding` · object: Whether the product's guided setup should open for this person. - `required` · boolean · required: `true` while nobody in the organization has finished or skipped the guided setup and this person has the permissions to run it. - `completed_at` · date-time · required: When the organization finished or skipped the guided setup. `null` until then. ### Example ```bash curl -X GET "$WITHHUMAN_URL/api/v1/me" \ -H "Authorization: Bearer $WITHHUMAN_API_KEY" ``` 200 response ```json { "principal": { "actor_type": "human", "actor_id": "7ab8c8ec-7b2d-4fd6-9b52-752f9515eb71", "organization_id": "7ab8c8ec-7b2d-4fd6-9b52-752f9515eb71", "membership_id": "7ab8c8ec-7b2d-4fd6-9b52-752f9515eb71", "agent_instance_id": "7ab8c8ec-7b2d-4fd6-9b52-752f9515eb71", "agent_slug": "claude-code", "permissions": [ "request.read", "request.decide", "agent.credential.issue" ], "grants": [ { "permission": "request.decide", "scope_kind": "organization", "scope_id": "string" } ], "team_ids": [ "7ab8c8ec-7b2d-4fd6-9b52-752f9515eb71" ], "auth": { "method": "local_password", "assurance": "strong", "authenticated_at": "2026-09-08T12:02:11Z", "session_id": "7ab8c8ec-7b2d-4fd6-9b52-752f9515eb71", "credential_id": "7ab8c8ec-7b2d-4fd6-9b52-752f9515eb71" } }, "user": { "display_name": "Ada Lovelace", "email": "ada@example.com", "has_password": true }, "organization": { "name": "Northwind", "slug": "northwind" }, "assignments": [ { "id": "7ab8c8ec-7b2d-4fd6-9b52-752f9515eb71", "organization_id": "7ab8c8ec-7b2d-4fd6-9b52-752f9515eb71", "principal_kind": "membership", "principal_id": "7ab8c8ec-7b2d-4fd6-9b52-752f9515eb71", "scope_kind": "organization", "scope_id": "string", "scope_name": "string", "source": "manual", "source_key": "string", "granted_by_actor_id": "7ab8c8ec-7b2d-4fd6-9b52-752f9515eb71", "via_team_id": "7ab8c8ec-7b2d-4fd6-9b52-752f9515eb71", "via_team_name": "string", "created_at": "2026-09-08T12:02:11Z", "permissions": [ "string" ], "is_owner": true, "permission_policy_id": "7ab8c8ec-7b2d-4fd6-9b52-752f9515eb71" } ], "onboarding": { "required": false, "completed_at": "2026-09-08T12:02:11Z" } } ```