> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nx1cloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Resolve your identity and roles

> Returns your identity and roles for the current request.

Send a request with an ``Authorization: Bearer <token>`` or ``Authorization-PSK: <psk>`` header to
get back your username, email, roles, and how you authenticated. Use this to verify your credentials
work correctly and to check your effective roles.

This is the REST alternative to the MCP ``whoami`` tool, which serves the same purpose for AI agents.



## OpenAPI

````yaml get /api/identity/whoami
openapi: 3.1.0
info:
  title: Nx1 AI API
  description: |

    AI API for Nx1 Data Platform Management and Automated Data Tasks.

    Authentication is required via PSK in Authorization header.

    Default PSK is | [ask a friend] |
  version: 0.10.2
servers: []
security: []
paths:
  /api/identity/whoami:
    get:
      tags:
        - Identity
      summary: Resolve your identity and roles
      description: >-
        Returns your identity and roles for the current request.


        Send a request with an ``Authorization: Bearer <token>`` or
        ``Authorization-PSK: <psk>`` header to

        get back your username, email, roles, and how you authenticated. Use
        this to verify your credentials

        work correctly and to check your effective roles.


        This is the REST alternative to the MCP ``whoami`` tool, which serves
        the same purpose for AI agents.
      operationId: whoami_api_identity_whoami_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WhoAmIResponse'
      security:
        - OAuth2AuthorizationCodeBearer: []
        - APIKeyHeader: []
components:
  schemas:
    WhoAmIResponse:
      properties:
        sub:
          type: string
          title: Sub
          description: Keycloak subject identifier of the caller.
        preferred_username:
          anyOf:
            - type: string
            - type: 'null'
          title: Preferred Username
          description: Username for user context. Equals 'psk' for the general PSK.
        email:
          anyOf:
            - type: string
            - type: 'null'
          title: Email
          description: Caller's email, if known.
        full_name:
          anyOf:
            - type: string
            - type: 'null'
          title: Full Name
          description: Caller's full name, if known.
        roles:
          items:
            type: string
          type: array
          title: Roles
          description: Realm roles assigned to the caller.
        client_roles:
          items:
            type: string
          type: array
          title: Client Roles
          description: Client roles assigned to the caller.
        auth_method:
          $ref: '#/components/schemas/AuthMethod'
          description: Which credential resolved the identity.
      type: object
      required:
        - sub
        - auth_method
      title: WhoAmIResponse
      description: |-
        Identity resolved by the API for the current request.

        Mirrors the MCP ``whoami`` tool: echoes back the caller's identity and
        the auth method that matched, so clients can verify their Bearer / PSK
        wiring and discover their effective roles.
    AuthMethod:
      type: string
      enum:
        - keycloak_token
        - user_psk
        - general_psk
      title: AuthMethod
      description: Tracks which credential you used to authenticate.
  securitySchemes:
    OAuth2AuthorizationCodeBearer:
      type: oauth2
      flows:
        authorizationCode:
          scopes: {}
          authorizationUrl: >-
            https://sso-rapid.rapid.nx1cloud.com/realms/rapid/protocol/openid-connect/auth
          tokenUrl: >-
            https://sso-rapid.rapid.nx1cloud.com/realms/rapid/protocol/openid-connect/token
    APIKeyHeader:
      type: apiKey
      in: header
      name: Authorization-PSK

````