The authenticated principal, user and workspace
Says who the credential authenticates as and what it may do: the principal with its scopes, the workspace, and for a cookie session the user and the management actions its role holds (permissions). An API key has no user, so user is null and permissions is empty; workspace is the key's workspace, or null for a legacy key that predates workspaces. The web app boots from this. It changes nothing.
Scope: sessions:read (API key or cookie session).
AuthorizationBearer <token>For servers and scripts: an API key sent as an HTTP bearer token, Bearer <key>. It holds exactly the scopes it was issued with; a key issued before scopes existed holds none. It never needs the CSRF header, and it cannot manage agents, members, teams or API keys. Issue one in the web console under Settings → API keys; each operation names the scope it needs.
Scope: sessions:read
The authenticated principal; scopes is what it may do.
application/json- response
principal*||user*|nullworkspace*|nullscopes*array<>permissions*array<>curl -X GET 'https://example.com/v1/auth/me'{ "principal": { "kind": "user", "id": "3e7f1a90-5c2d-4b8e-8f61-2a9d0c4b7e35", "workspace_id": "9d2c4e61-8a3b-4f70-b1e5-6c0a7d3f2b98", "role": "owner", "scopes": [ "sessions:read", "sessions:write", "sessions:approve", "sessions:control", "sessions:recover" ] }, "user": { "id": "3e7f1a90-5c2d-4b8e-8f61-2a9d0c4b7e35", "email": "owner@example.com", "display_name": "Ada Owner", "locale": "ko" }, "workspace": { "id": "9d2c4e61-8a3b-4f70-b1e5-6c0a7d3f2b98", "slug": "acme", "name": "Acme", "settings": { "dispatch_model": null, "kill_switch": false, "daily_cost_limit_usd": null, "idle_pause_minutes": 30, "audit_retention_days": 90, "slack_guest_enabled": false, "achievement_judge": { "connection_id": null, "threshold": 0.9, "on_evidence": true, "every_n_turns": null, "on_idle": false, "transcript": "recent", "daily_budget_usd": 1, "max_per_session": 20 } }, "created_at": "2026-10-01T09:00:00Z" }, "scopes": [ "sessions:read", "sessions:write", "sessions:approve", "sessions:control", "sessions:recover" ], "permissions": [ "workspace.manage", "audit_retention.manage", "member.manage", "team.manage", "api_key.manage", "api_key.manage_own", "account.link", "agent.create", "agent.manage", "agent.restore", "agent.admin.manage", "credential.bind", "binding.manage", "session.audit_read", "session.admin_list", "usage.installation_read", "usage.agent_read", "profile.installation.manage", "profile.define", "installation.settings.manage" ]}