Me — Core API

Returns who the Core API considers the caller to be, based on the presented credential — the equivalent of AWS STS GetCallerIdentity.

The response has one uniform shape for every credential type:

• type identifies the credential: api_key (HTTP Basic), user (Bearer JWT), or personal_token (Bearer PAT).
• accounts is always an array of the verified accounts this credential can act on, each with the authorization scopes held on it. Account API keys yield exactly one entry; user tokens one per account membership; credentials with no account access yield an empty array.
• Each account entry carries both account_id and the underlying org_id — accounts are facades over organizations in AuthPI's own issuer.
• organizations is always an array of the tenant organizations this credential can act on — organizations inside an issuer that are not accounts. An organization-scoped API key yields exactly one entry with the key's scopes; account credentials yield an empty array.

Use this to resolve the account for a credential without configuration: when accounts has exactly one entry, that is the account to operate on. The admin SDKs use this endpoint to make accountId optional.

This is also the verification call for tenant credentials: a customer's API that receives an organization API key presents it here and reads back which organization is calling (organizations[0].org_id) and what it may do (organizations[0].scopes) — the equivalent of AWS STS GetCallerIdentity for tenant machine credentials. Each successful verification emits an api-key.verified event.