GET /auth/me
Whoami for the user behind the credential: user row, every org they belong to, MFA state. The single canonical "who am I" call.
For an Api-Key: request, that's the user who minted the key. For a dashboard-session (Authorization: Bearer …) request, it's the user who logged in.
Response 200
{
"id": "0a2a3f…",
"email": "alice@example.com",
"first_name": "Alice",
"last_name": "Nguyen",
"mfa_required": false,
"mfa_active": true,
"mfa_passed": true,
"email_verified": true,
"changelog_subscribed": false,
"created_at": "2026-04-01T14:22:00Z",
"memberships": [
{
"org_id": "b3c7…",
"org_name": "Acme Inc.",
"role": "admin"
}
]
}| Field | Notes |
|---|---|
id | User UUID. |
email | |
first_name | Display name. null until the user sets it. Always paired with last_name. |
last_name | Display name. null until the user sets it. Always paired with first_name. |
mfa_required | Whether the account is required to use MFA (admin-set on the user). |
mfa_active | Whether the user has actually activated TOTP. |
mfa_passed | Whether the current session has cleared MFA. Always true on Api-Key: calls (keys aren't subject to MFA). For token sessions, mirrors the JWT claim. |
email_verified | Whether the user has verified their email address (true once verified). |
changelog_subscribed | Whether this user receives the changelog by email. Set it from the dashboard's org page, or with PATCH /v0/users/me. |
created_at | ISO-8601. |
memberships[] | One row per org the user belongs to. role is per-membership. |
superuser | Internal flag. Omitted from the response when false. |
internal | Internal flag. Omitted from the response when false. |
Example
curl "$SEISMIC_ORCHESTRATION_URL/v0/auth/me" \
-H "Api-Key: $SEISMIC_ORCHESTRATION_API_KEY"