GET /api/v1/me

GET /api/v1/me

GET /api/v1/me

cURL

curl --request GET \
  --url https://api.tetrafi.io/api/v1/me \
  --header 'X-API-Key: <api-key>'

200

{
  "auth": "apiKey",
  "authKind": "apiKey",
  "dataScope": "<string>",
  "keyId": "<string>",
  "name": "<string>",
  "origin": "<string>",
  "permissions": [
    "<string>"
  ],
  "scopes": [
    "<string>"
  ],
  "expiresAt": "<string>",
  "organisationWallets": {
    "grants": [
      {
        "financialAccountId": "<string>",
        "grantedAt": "2023-11-07T05:31:56Z",
        "grantedBy": "<string>",
        "organisationWalletId": "<string>"
      }
    ],
    "requestSigningRequired": true,
    "venueTradeEnabled": true,
    "venueTradeScope": true,
    "blockedBy": "<string>"
  },
  "rateLimits": {
    "burstSize": 1,
    "requestsPerMinute": 1
  },
  "workspaceId": "<string>"
}

Authorizations

api_keybearer_auth

X-API-Key · string · header · required

Send the API key in X-API-Key.

Request signing. A key with signing enabled (POST /api/v1/workspaces/{workspaceId}/users/me/api-keys/{keyId}/signing, which returns the signing secret once) must also sign every request:

• X-Timestamp: the current Unix time in seconds, within 300 seconds of the server clock.
• X-Signature: lower-case hex HMAC-SHA256 of the canonical string, keyed with the signing secret's 32 bytes (the secret is 64 hex characters; decode it first).

The canonical string is four lines joined by \n, with no trailing newline: the X-Timestamp value, the upper-case method, the path with its query exactly as sent (/api/v1/orders?limit=1), and the lower-case hex SHA-256 of the exact body bytes (the SHA-256 of an empty body when there is none).

A write's signature (POST, PUT, PATCH, DELETE) is accepted once: sending the same signed write again is refused, so a retry signs again. A read (GET, HEAD) changes nothing, so an identical signed read inside the window is admitted again and polling needs no nonce.

A signing refusal is a 401 AUTH_REQUIRED whose details.reason names the cause: SIGNATURE_REQUIRED (a header is missing), SIGNATURE_INVALID (a malformed header or a wrong signature), TIMESTAMP_OUT_OF_RANGE or SIGNATURE_REPLAYED.

Headers

X-Workspace-Id · string<uuid>

The workspace the request acts in. An API key bound to a workspace implies it: omit the header, or send that same id (another id answers 403 WORKSPACE_SCOPE_MISMATCH). A member session must send it (400 MISSING_WORKSPACE without it).

Query Parameters

include · string

Comma-separated: profile, permissions, verification. An interactive session only, except permissions, which an API key's answer always carries

Response

200

application/json

Presented JWT identity or API-key identity. A service account's bearer token (POST /api/v1/oauth/token) answers the identity of the key it was exchanged from, with auth oauthClientCredentials and only the scopes the token was issued, narrowed by the key's live rights. An unrestricted key returns the complete explicit scope list, intersected with live workspace IAM and qualifying native resource-read envelopes. TreasuryRead does not grant global Treasury visibility. A workspace key also reads its own organisation-wallet grants and signing state (organisationWallets). An interactive session is checked against its current account and session on every request; include adds its profile, permissions and verification.

Option 1

Option 2

New values may be added; treat unknown values as other.

auth · enum<string> · required

How this request authenticated: the key itself, or a bearer token exchanged from it (POST /api/v1/oauth/token), which carries only the scopes it was issued.

Available options: apiKey, oauthClientCredentials

authKind · enum<string> · required

New values may be added; treat unknown values as other.

Available options: apiKey

dataScope · string · required

keyId · string · required

name · string · required

origin · string · required

permissions · string[] · required

scopes · string[] · required

expiresAt · string | null

organisationWallets · null | object

This key's own organisation-wallet venue trading. Absent for a key bound to no workspace.

Show child attributes

rateLimits · null | object

Show child attributes

workspaceId · string | null