Validate an API key
GET /v1/whoami
Confirms that an API key is valid and active, and echoes its
non-sensitive metadata. This operation is scope-agnostic: any valid,
active API key authenticates, so an integrator can verify a key works —
including an ingest-only key that holds no control-plane scope — without
sending real telemetry. There is no per-route scope check.
Because it enforces no scope, an OAuth Bearer token can never satisfy it;
the operation accepts the X-API-Key scheme only.
The key secret is never returned, and the data payload is tiered by
scope. A key holding any of analytics:read, resources:write, or
data:admin (a server-side Developer Platform credential) receives the
full metadata set (projectId, projectName, tenantId, planId,
scopes). A pure data-plane key (only events:write and/or
events:synthetic, embedded in a shipped game client) is write-only by
contract and receives just projectId and scopes — never the tenant,
project name, or plan tier.
Authorizations
Section titled “Authorizations ”Responses
Section titled “ Responses ”The key is valid. projectId and scopes are always present;
projectName, tenantId, and planId are present only for keys
holding a metadata scope (analytics:read, resources:write, or
data:admin).
object
object
The project the key is bound to.
Human-readable project name. Present only for keys with a metadata scope.
The owning tenant. Present only for keys with a metadata scope.
The tenant’s plan tier. Present only for keys with a metadata scope.
The scopes granted to the key.
Headers
Section titled “Headers ”Maximum number of requests allowed per hour.
Number of requests remaining in the current window.
Unix timestamp when the rate limit window resets.
Missing or invalid API key.
RFC 9457 Problem Details. Served with the application/problem+json
media type. error_category, retryable, and retry_after are
Framedash extension members. type always defaults to about:blank,
so it is always present; detail and the extension members are present
only when applicable.
object
Problem type URI; about:blank when no specific type applies.
Short, human-readable summary of the problem type.
HTTP status code.
Human-readable explanation specific to this occurrence.
Extension member categorizing the error.
Extension member; true when retrying may succeed (e.g. 429, 503).
Extension member; suggested retry delay in seconds, when applicable.
Rate limit exceeded. Key validation uses an isolated per-tenant
bucket (60 requests/hour) that is separate from the plan quota, so
validating a key never consumes an operation’s request budget. The
Retry-After header is derived from the sliding window’s reset
time, so honor the value on each response; the X-RateLimit-*
headers describe the same window.
RFC 9457 Problem Details. Served with the application/problem+json
media type. error_category, retryable, and retry_after are
Framedash extension members. type always defaults to about:blank,
so it is always present; detail and the extension members are present
only when applicable.
object
Problem type URI; about:blank when no specific type applies.
Short, human-readable summary of the problem type.
HTTP status code.
Human-readable explanation specific to this occurrence.
Extension member categorizing the error.
Extension member; true when retrying may succeed (e.g. 429, 503).
Extension member; suggested retry delay in seconds, when applicable.
Headers
Section titled “Headers ”Number of seconds to wait before retrying. Present only on 429
responses. Because the limit uses a sliding window, honor this value
per response rather than scheduling a retry for the reset time.
Maximum number of requests allowed per hour.
Number of requests remaining in the current window.
Unix timestamp when the rate limit window resets.