The calling credential's identity, workspace, effective and granted scopes
/v1/whoamiReports which credential the presented token belongs to, which workspace that credential is bound to, and two scope sets: scopes is what THIS token can do (its own scope claim intersected with the credential's live grant) and credentialScopes is what an administrator has granted the credential. credentialExpiresAt and attestationDueAt say when the credential stops working unless an administrator rotates or attests it. It requires a valid token but no scope, deliberately, so it stays the one call that separates a bad secret from a missing scope. Call it once after minting a token, and again whenever a call is refused with 403: the difference between the two sets says which side to change.
Authorization
bearerAuth Obtain a token from https://id.ovidens.com/oauth/token using the client_credentials grant.
In: header
curl -X GET "https://example.com/v1/whoami"{ "clientId": "ovc_7f3a9c1d2e4b6a8c0d5e7f91", "name": "ERP nightly import", "tenantId": "3f1c9a52-4d7e-4b60-9a1f-2c8d5e7b0a34", "workspaceName": "Contoso", "scopes": [ "workspace:read", "data:write", "pipeline:run" ], "credentialScopes": [ "workspace:read", "data:write", "pipeline:run", "exports:read" ], "tokenExpiresAt": "2026-08-02T09:30:00.000Z", "credentialExpiresAt": "2027-06-30T09:30:00.000Z", "attestationDueAt": "2026-10-01T09:30:00.000Z"}Response Body
application/json
application/json
application/json