What the credential you present is worth

GET

/v1/me

const url = 'https://api.eu.apigami.com/v1/me';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://api.eu.apigami.com/v1/me \
  --header 'Authorization: Bearer <token>'

One route for every Apigami credential, because the question is always the same. A user session, a personal token or an agent token answers with the account and its team; an API key with the application it runs; the run token a hosted application is handed answers with the invocation it is serving — which application, which action or page, which version and whether that version serves production. A page’s token is refused, with the same 401, when the request comes from another origin than its page’s. Everything the token was worth when it was minted is re-read: its life, its parents, the team, the authorisation that allowed the call, and, for an invocation with a browser, that the user has not disconnected it. Any of those gone is a 401. There is nothing to send: the answer is derived from the credential, so it can only ever describe that credential. It never returns a browser identifier.

Authorizations

apiKey

Parameters

Query Parameters

path

string

<= 1024 characters

For the token of a page full page at its application’s own address, the path the page sits on: the answer then names that page in page_id and page_kind. apigami.js sends it for you.

Responses

200

What the credential is worth. subject says which shape it is.

application/json

One of:

object

subject

required

string

Allowed values: user

user_id

required

string format: uuid

group_id

required

string format: uuid

email

required

string | null

object

subject

required

string

Allowed values: run

valid

boolean

run_id

required

string format: uuid

called_app_id

required

The application this invocation is running — yours, when you read this with your own run token.

string format: uuid

caller_app_id

The application that called this one, when one did. For a page’s token, the application the person connected to, however many applications lie between: its page is opened for that one.

string | null format: uuid

root_app_id

required

The application the user connected to. It never changes down a chain of calls.

string format: uuid

version_id

string | null format: uuid

production

required

Whether that version is the one serving production right now. Compare it with your own APIGAMI_VERSION_ID before any effect.

boolean

context

required

extension: a browser is engaged. application: none is.

string

Allowed values: extension application

action

string | null

user_ref

The person this invocation serves, as your group knows them. For the application they connected to, the same user_ref its webhooks and POST /connect/token carry; called as a dependency, a ref no route of your key knows, since they never connected to your application. Null when the invocation serves nobody. An API-key call that names a user with X-Apigami-User-Ref keeps them, with or without a browser.

string | null

browser_pseudonym

A stable reference to the browser, for this application only. It says two invocations came from the same one, and nothing more. Never a browser identifier.

string | null

page_id

The id of the page this token was opened for, as your manifest declares it; for a page full page at its application’s own address, the page served at path. Null for any token that is not a page’s.

string | null

page_kind

The kind of that page. A home page opens full page from the application’s connect link. A settings page is the side panel’s last tab, and also opens full page from that link when there is no home.

string | null

Allowed values: side_panel settings home

install_ref

The browser a page’s token drives, as your group knows it: the same install_ref the side panel hands the page, and a page opened full page reads here. Null for a page without a browser and for any token that is not a page’s.

string | null

settings_needed

What the person this invocation serves still has to do, for the called application or one it reaches: an action of that application answered X-Apigami-Settings: setup or reconnect, and none has answered ok since. Empty when there is nothing, or when the invocation serves nobody. Send the person to the connect link of the application they connected to: its home page shows the settings of the applications it calls.

Array<object>

object

app_id

required

string format: uuid

name

required

string

kind

required

string

Allowed values: setup reconnect

since

required

string format: date-time

has_settings_page

For a page’s token, whether the version serving it also declares a settings page: apigami.js then adds a « Settings » button to the home.

boolean

expires_at

required

string format: date-time

Example

{
  "subject": "user"
}

401

No credential, or one that is no longer worth anything.

application/json

object

error

required

string

consentPending

Present and true when the approval window is open and the user has not answered within 45 s.

boolean

Example

{
  "error": "bad run token"
}