Get the authenticated caller's identity and resolved scope
Authorizations
Caller API key issued by scripts/generate-api-key.ts. Sent as Authorization: Bearer . Verified against a stored SHA-256 hash in constant time by packages/api/src/auth/StaticKeyAuthenticator.ts. Required on every route except GET /health. See /api-reference/authentication.
Response
The authenticated caller's identity and resolved scope.
Response returned by GET /callers/me (packages/api/src/routes/callers-me.ts). Resolved, not raw: allowedPrincipalIds/allowedCapabilities reflect the effective scope after defaults are applied (isPrincipalAllowed.ts / isCapabilityAllowed.ts), not the raw ApiKeyEntry configuration. Never returns key material.
The authenticated caller's identity.
Principal IDs this caller may assert as authority.principalId. Defaults to [callerId] when the key's allowedPrincipalIds is unset.
Capabilities (intent.action values) this caller may execute. Defaults to an empty array, not all capabilities, when the key's allowedCapabilities is unset.
True when allowedCapabilities contains the wildcard "*".