# Auth · Management API

> Management API reference for auth: GET /whoami.

> Markdown version of https://kanorio.com/en/developers/management-api/auth. Append `.md` to any developer docs URL for this format. Index: https://kanorio.com/llms.txt · MCP: https://app.kanorio.com/api/mcp

Base URL: `https://app.kanorio.com/api/v1` · [Errors](https://kanorio.com/en/developers/basics/errors) · [Pagination](https://kanorio.com/en/developers/basics/pagination)

### Auth whoami

`GET /whoami`

- Stability: beta
- Rate limit: default (120/minute per token)
- MCP tool: `auth_whoami`

Inspect the current token's granted scopes, website restrictions, and any capabilities hidden from tools/list (with the exact reason: missing_scope or feature_disabled). Call this before telling the user a feature is unsupported. Pass websiteId to also get your team role on that website and the effective permissions there (token scopes intersected with the role's permissions), plus capabilities your token has the scope for but your role does not allow on that website. Errors: UNAUTHORIZED, FORBIDDEN (websiteId given but you are not a member of that website).

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `websiteId` | query | string | no | Optional: also report your role and effective permissions on this website. |

**Response** (200)

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `userId` | string | yes | Authenticated user id. |
| `tokenId` | string | yes | Current token id. |
| `channel` | string | yes | Request channel (mcp or api). |
| `scopes` | string[] | yes | Permission scopes granted to this token. |
| `websiteScope` | "all" \| "restricted" | yes | Whether the token can access all of the user's websites or only specific websiteIds. |
| `websiteIds` | string[] \| null | yes | Allowed websiteIds when websiteScope is 'restricted'; null when 'all'. |
| `hiddenCapabilities` | object[] | yes | — |
| `hiddenCapabilities[].name` | string | yes | Capability name. |
| `hiddenCapabilities[].reason` | "missing_scope" \| "feature_disabled" | yes | Why the capability is hidden from tools/list. |
| `hiddenCapabilities[].requiredScope` | string \| null | yes | Scope needed to unlock this capability. |
| `site` | object | no | Present when websiteId is passed. |
| `site.websiteId` | string | yes | — |
| `site.role` | "owner" \| "admin" \| "custom" | yes | Your team role kind on this website. |
| `site.roleName` | string \| null | yes | Custom role name set by the site owner; null for owner and admin. |
| `site.memberPermissions` | string[] | yes | Permissions your team role grants on this website. |
| `site.effectivePermissions` | string[] | yes | What calls on this website can actually do: token scopes intersected with memberPermissions. |
| `site.blockedByRole` | object[] | yes | Capabilities your token has the scope for but your role does not allow here; ask the site owner or an admin to change your role. |
| `site.blockedByRole[].name` | string | yes | — |
| `site.blockedByRole[].requiredPermission` | string | yes | — |

**Errors**

| Code | Status | When |
| --- | --- | --- |
| `UNAUTHORIZED` | 401 | — |
| `FORBIDDEN` | 403 | websiteId given but you are not a member of that website |

```bash
curl -X GET "https://app.kanorio.com/api/v1/whoami" \
  -H "Authorization: Bearer $KANORIO_TOKEN"
```

```json
{
  "userId": "usr_example01",
  "tokenId": "tok_example01",
  "channel": "mcp",
  "scopes": [
    "console:view",
    "editor:enter",
    "content:edit"
  ],
  "websiteScope": "all",
  "websiteIds": null,
  "hiddenCapabilities": [
    {
      "name": "site.publish",
      "reason": "missing_scope",
      "requiredScope": "site:lifecycle"
    }
  ]
}
```