Get the authenticated caller's identity and resolved scope
The proof artifact a security review asks for: ‘show me this agent’s identity and exactly what it’s authorized to do.’ Read-only, self-lookup only, an authenticated caller sees its own record, never another caller’s, and this never retur…
Authorizations
Caller API key issued by scripts/generate-api-key.ts. Sent as Authorization: Bearer . Verified against a stored SHA-256 hash in constant time by packages/api/src/auth/StaticKeyAuthenticator.ts. Required on every route not listed as exempt in this document's top-level description. See /api-reference/authentication.
Response
The authenticated caller's identity and resolved scope.
Response returned by GET /callers/me (packages/api/src/routes/callers-me.ts). Resolved, not raw: allowedPrincipalIds/allowedCapabilities reflect the effective scope after defaults are applied (isPrincipalAllowed.ts / isCapabilityAllowed.ts), not the raw ApiKeyEntry configuration. Never returns key material.
The authenticated caller's identity.
Principal IDs this caller may assert as authority.principalId. Defaults to [callerId] when the key's allowedPrincipalIds is unset.
Capabilities (intent.action values) this caller may execute. Defaults to an empty array, not all capabilities, when the key's allowedCapabilities is unset.
True when allowedCapabilities contains the wildcard "*".