Skip to main content
GET
Get the organization a token acts in

Authorizations

Authorization
string
header
required

Personal access token of a ROOTKey user, sent as Authorization: Bearer rk_pat_.... A token acts as the user who created it, in the organization named by the X-RootKey-Organization header, and never with more access than that user has in the ROOTKey app: the organization's agent policy, the user's own role and teams, and the token's scopes (rootkey.read, rootkey.write, rootkey.delete) all apply. A missing, malformed, unknown, revoked or expired token gets the same 401. Send either an x-api-key or a bearer token, never both: a request with both gets conflicting_credentials. See Authentication.

Headers

X-RootKey-Organization
string

The organization a personal access token acts in: the id of one of the organizations that GET /organizations lists. Required with a personal access token on every endpoint that works inside an organization; without it the request gets organization_header_required. Ignored with an API key, which belongs to exactly one organization.

x-test-mode
enum<string>
default:false

Whether a personal access token works on live data (false, the default) or on test data (true). Only this header decides, never a query string or a body field. An API key is itself a test or a live key and works on that data.

Available options:
true,
false

Response

The organization as the token sees it

id
string
name
string
mode
enum<string>

What the organization lets agents do: DISABLED serves no agent request, READ_ONLY only reads, FULL reads, writes and deletes. An organization that never saved a policy is READ_ONLY.

Available options:
DISABLED,
READ_ONLY,
FULL
effectiveScopes
enum<string>[]

The token's own scopes narrowed by what the organization allows now: none when agents are disabled, when the user is blocked, when the organization requires two-factor authentication and the user has none, or when it does not allow personal access tokens; only rootkey.read (when the token has it) in a read-only organization; the token's scopes otherwise. It never adds a scope the token does not hold. The user's role can still refuse an individual request.

Available options:
rootkey.read,
rootkey.write,
rootkey.delete