# impartire API — Reference: Who is calling

Every path is under `https://impartire.com/api/v1`. The machine-readable contract is https://impartire.com/api/v1/openapi.json (OpenAPI 3.1).

#### GET /api/v1/me

Who is calling: the key, its org, its scopes and its request budget

Any valid key may call it, whatever its scopes.

Scopes: any valid credential

Response 200 — `Me`: Who is calling: the credential, its org, its authority, its scopes and its request budget.

- `authority` ("org" | "user", required) — `org`: an org API key — its scopes, org-wide. `user`: an OAuth access token acting for one person — its scopes AND that person's own permissions, so it sees what they see and does what they may do.
- `org` (object, required) — The org this credential acts in.
  - `id` (string (uuid), required)
  - `name` (string, required)
- `credential_class` ("standard" | "guarded", required) — `guarded` when the credential holds any guarded scope (runs:signal, delivery:write, schedules:write, channels:control, access:write, sharing:write); `standard` otherwise. A guarded key must expire within 90 days and acts at once. With a guarded token, each guarded action waits for its person to confirm it in impartire.
- `key` (object or null, required) — The API key, for `authority: org`; null for a token.
  - `id` (string (uuid), required)
  - `name` (string, required)
  - `scopes` (array of string, required) — What this key may do. `<resource>:write` includes `<resource>:read`.
  - `expires_at` (string (date-time) or null, required) — When the key stops working, or null if it does not expire.
  - `created_at` (string (date-time), required)
- `user` (object or null, required) — The person a token acts for, for `authority: user`; null for a key.
  - `id` (string, required)
  - `name` (string, required)
  - `email` (string, required)
- `client_id` (string or null, required) — The OAuth client acting for the person (a URL for a client that published a metadata document); null for a key.
- `scopes` (array of string, required) — What this credential may do. `<resource>:write` includes `<resource>:read`.
- `rate_limit` (object, required)
  - `limit` (integer, required) — Requests allowed per window, per credential. Enforced approximately (per edge location, eventually consistent): a burst can exceed it before the first 429.
  - `window_seconds` (integer, required)

Other responses:

- 401 (Problem) — unauthenticated — no key, or an unknown, revoked or expired one.
- 403 (Problem) — insufficient-scope — the key lacks a required scope.
- 404 (Problem) — not-found.
- 429 (Problem) — rate-limited — the key's request budget is spent; wait Retry-After seconds.
- 500 (Problem) — internal.