curl --request GET \
--url https://api.rootkey.ai/api-v1/organization \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.rootkey.ai/api-v1/organization"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.rootkey.ai/api-v1/organization', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.rootkey.ai/api-v1/organization",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.rootkey.ai/api-v1/organization"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.rootkey.ai/api-v1/organization")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.rootkey.ai/api-v1/organization")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"id": "<string>",
"name": "<string>",
"mode": "DISABLED",
"effectiveScopes": [
"rootkey.read"
]
}{
"error": {
"requestId": "<string>",
"message": "<string>",
"errorCode": "<string>",
"docUrl": "<string>",
"timestamp": "2023-11-07T05:31:56Z"
}
}{
"error": {
"requestId": "<string>",
"message": "<string>",
"errorCode": "<string>",
"docUrl": "<string>",
"timestamp": "2023-11-07T05:31:56Z"
}
}{
"error": {
"requestId": "<string>",
"message": "<string>",
"errorCode": "<string>",
"docUrl": "<string>",
"timestamp": "2023-11-07T05:31:56Z"
}
}Get the organization a token acts in
Returns the organization named by X-RootKey-Organization as the token sees it: its name, its agent mode and the scopes the token effectively has there. It needs the rootkey.read scope. When the organization does not allow the request, the answer is the 403 whose errorCode says why, so this is the call to make first to find out whether a token can work in an organization. Only a personal access token can call it: a request with an API key gets the 404 that any path the API does not have gets.
curl --request GET \
--url https://api.rootkey.ai/api-v1/organization \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.rootkey.ai/api-v1/organization"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.rootkey.ai/api-v1/organization', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.rootkey.ai/api-v1/organization",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.rootkey.ai/api-v1/organization"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.rootkey.ai/api-v1/organization")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.rootkey.ai/api-v1/organization")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"id": "<string>",
"name": "<string>",
"mode": "DISABLED",
"effectiveScopes": [
"rootkey.read"
]
}{
"error": {
"requestId": "<string>",
"message": "<string>",
"errorCode": "<string>",
"docUrl": "<string>",
"timestamp": "2023-11-07T05:31:56Z"
}
}{
"error": {
"requestId": "<string>",
"message": "<string>",
"errorCode": "<string>",
"docUrl": "<string>",
"timestamp": "2023-11-07T05:31:56Z"
}
}{
"error": {
"requestId": "<string>",
"message": "<string>",
"errorCode": "<string>",
"docUrl": "<string>",
"timestamp": "2023-11-07T05:31:56Z"
}
}Authorizations
Personal access token of a ROOTKey user, sent as Authorization: Bearer rk_pat_.... A token acts as the user who created it, in the organization named by the X-RootKey-Organization header, and never with more access than that user has in the ROOTKey app: the organization's agent policy, the user's own role and teams, and the token's scopes (rootkey.read, rootkey.write, rootkey.delete) all apply. A missing, malformed, unknown, revoked or expired token gets the same 401. Send either an x-api-key or a bearer token, never both: a request with both gets conflicting_credentials. See Authentication.
Headers
The organization a personal access token acts in: the id of one of the organizations that GET /organizations lists. Required with a personal access token on every endpoint that works inside an organization; without it the request gets organization_header_required. Ignored with an API key, which belongs to exactly one organization.
Whether a personal access token works on live data (false, the default) or on test data (true). Only this header decides, never a query string or a body field. An API key is itself a test or a live key and works on that data.
true, false Response
The organization as the token sees it
What the organization lets agents do: DISABLED serves no agent request, READ_ONLY only reads, FULL reads, writes and deletes. An organization that never saved a policy is READ_ONLY.
DISABLED, READ_ONLY, FULL The token's own scopes narrowed by what the organization allows now: none when agents are disabled, when the user is blocked, when the organization requires two-factor authentication and the user has none, or when it does not allow personal access tokens; only rootkey.read (when the token has it) in a read-only organization; the token's scopes otherwise. It never adds a scope the token does not hold. The user's role can still refuse an individual request.
rootkey.read, rootkey.write, rootkey.delete Was this page helpful?

