> ## Documentation Index
> Fetch the complete documentation index at: https://docs.murmur.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Get caller identity

> WhoAmI returns the authenticated caller's identity.



## OpenAPI

````yaml /api-reference/openapi.json get /v1/whoami
openapi: 3.0.0
info:
  title: Murmur REST API
  description: >-
    PRE-ALPHA: INTERFACE SUBJECT TO CHANGE WITHOUT NOTICE.


    The murmur REST API lets you spawn agents, track their progress, manage
    their task lists, and read and write catalog resources from any HTTP client.
  version: v1
servers:
  - url: https://api.murmur.dev
security:
  - ApiKey: []
tags:
  - name: MurmurService
paths:
  /v1/whoami:
    get:
      tags:
        - MurmurService
      summary: Get caller identity
      description: WhoAmI returns the authenticated caller's identity.
      operationId: MurmurService_WhoAmI
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v1WhoAmIResponse'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/googleRpcStatus'
components:
  schemas:
    v1WhoAmIResponse:
      type: object
      properties:
        tenant:
          $ref: '#/components/schemas/v1Tenant'
        principal:
          $ref: '#/components/schemas/v1Principal'
        avatarUrl:
          type: string
      description: >-
        The authenticated caller's identity. tenant is the isolation boundary
        (provider + org). principal is the actor — an identity-provider user or
        a service profile — and is unset for callers that own no self-listable
        namespace (plain token keys, agent runtime).
    googleRpcStatus:
      type: object
      properties:
        code:
          type: integer
          format: int32
          description: >-
            Numeric status code for the failure, matching the HTTP status of the
            response via the standard mapping (e.g. 3 INVALID_ARGUMENT → 400, 5
            NOT_FOUND → 404, 7 PERMISSION_DENIED → 403, 16 UNAUTHENTICATED →
            401).
        message:
          type: string
          description: Human-readable description of what caused the failure.
        details:
          type: array
          items:
            $ref: '#/components/schemas/protobufAny'
          description: >-
            Machine-readable error details, when the failure carries them.
            Usually empty.
      description: The error envelope returned on every non-2xx response.
    v1Tenant:
      type: object
      properties:
        provider:
          $ref: '#/components/schemas/v1Provider'
        org:
          type: string
          title: username or org name
      description: |-
        Tenant identifies an organization within a provider. It is the unit of
        multi-tenant scoping — all resources (agents, pools, VMs) belong to
        exactly one tenant.
    v1Principal:
      type: object
      properties:
        provider:
          $ref: '#/components/schemas/v1Provider'
        account:
          type: string
      description: >-
        Principal identifies the actor a caller authenticates as within a
        tenant:

        either an IdP user (provider = the auth provider, account = username) or
        a

        service profile (provider = PROVIDER_SERVICE_PROFILE, account = profile

        name). It is the "who" that owns a self-listable namespace, distinct
        from

        Tenant's "where". The two map directly onto an AgentId's owner_provider
        and

        account. An unset Principal means the caller owns no self-listable
        namespace

        (e.g. a plain token key or an agent-runtime credential).
    protobufAny:
      type: object
      properties:
        '@type':
          type: string
          description: >-
            Identifies the payload type of this detail value; the remaining
            properties are that type's fields.
      additionalProperties: {}
      description: >-
        A structured detail value. `@type` identifies the payload type; the
        remaining properties are that type's fields.
    v1Provider:
      type: string
      enum:
        - PROVIDER_UNSPECIFIED
        - PROVIDER_GITHUB_OAUTH
        - PROVIDER_GITHUB_APP
        - PROVIDER_GOOGLE_OIDC
        - PROVIDER_SERVICE_PROFILE
      default: PROVIDER_UNSPECIFIED
      description: |-
        Provider identifies the identity provider type for a tenant namespace.
        Each provider is a distinct namespace — no cross-provider mixing.

         - PROVIDER_GITHUB_OAUTH: the namespace of an individual GitHub user — a single login (human or bot, e.g. "alice"), addressed as github_oauth/{login}
         - PROVIDER_GITHUB_APP: the org/tenant namespace — its account is the org name (github_app/{org}), never a person
         - PROVIDER_GOOGLE_OIDC: Google Workspace domain
         - PROVIDER_SERVICE_PROFILE: owner is a CatalogServiceProfile; account is the profile name
  securitySchemes:
    ApiKey:
      type: http
      scheme: bearer
      description: 'murmur API key: mur_<key_id>.<secret>'

````