Get the calling identity

GET

/me

const url = 'https://qinto-api.blotout.io/me';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://qinto-api.blotout.io/me \
  --header 'Authorization: Bearer <token>'

Returns who is calling: the identity behind the presented token, the teams it may access, and the access it carries. Call it to confirm a credential works and to discover the teamId other operations need.

How it works

A team API token identifies only itself and its one team. A user-authorized OAuth token reports each team selected during consent. user is filled only when that grant includes the profile scope, and organizations when it includes profile, developer or bundles.

Required permissions

None beyond a valid token; user additionally requires the profile scope on the token’s grant, and organizations the profile, developer or bundles scope

Authorizations

QintoAccessToken

Responses

200

The identity behind the presented token.

application/json

object

tokenType

required

How the caller authenticated: a user-authorized OAuth token or a team API token.

string

Allowed values: oauth api_token

name

required

For an OAuth token, the authorized app’s name; for a team API token, the token’s own name.

string

user

required

The authorizing user; null for team API tokens and for OAuth tokens granted without the profile scope.

object

userId

required

Server-assigned unique id of the authorizing user.

string

email

required

Email address of the authorizing user.

string

firstName

required

First name, or null when never provided.

string | null

lastName

required

Last name, or null when never provided.

string | null

teams

required

Every team this credential may access, with its independently granted scope.

Array<object>

A team this credential may access.

object

teamId

required

Server-assigned unique id of the team.

string

name

required

Display name of the team, or null when it has never been named.

string | null

createdAt

required

When the team was created, as an ISO 8601 UTC timestamp.

string format: date-time

scopes

required

The access granted specifically in this team.

Array<string>

organizations

required

Every developer organization the authorizing user belongs to; empty without the profile, developer or bundles scope and for team API tokens.

Array<object>

A developer organization the authorizing user belongs to.

object

organizationId

required

Server-assigned unique id of the developer organization.

string

name

required

Display name of the developer organization.

string

role

required

The user’s role in the organization: owner, developer or member.

string

scopes

required

The presented token’s access as scope tokens: an OAuth token’s granted scope, or a team API token’s policies expressed as scopes.

Array<string>

Example

{
  "tokenType": "oauth",
  "name": "Qinto CLI",
  "user": {
    "userId": "9c2f4b71-3d58-4a06-b1e2-7f40c8a5d312",
    "email": "dev@example.com",
    "firstName": "Ada",
    "lastName": "Lovelace"
  },
  "teams": [
    {
      "teamId": "7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9",
      "name": "Acme",
      "createdAt": "2026-06-18T00:00:00.000Z",
      "scopes": [
        "team:write"
      ]
    }
  ],
  "organizations": [
    {
      "organizationId": "5e8c2d90-4b17-4f3a-9d21-8a63f0b7c154",
      "name": "Acme Dev",
      "role": "owner"
    }
  ],
  "scopes": [
    "team:write"
  ]
}

401

unauthenticated — The Authorization: Bearer token is missing, malformed, or no longer valid. Generate a team API token or obtain a new OAuth access token.

application/json

object

error

required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string

Allowed values: unauthenticated

Example

{
  "error": "unauthenticated"
}

500

internal — Unexpected server error. Nothing is guaranteed to have been persisted; idempotent operations are safe to retry.

application/json

object

error

required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string

Allowed values: internal

Example

{
  "error": "internal"
}