Introspect the current token

GET /session-token/me

Response Body

allowed_origins_countinteger

Session tokens only. How many origins govern this session. The list itself is never returned. Zero means nothing may frame the widget.

Example: 1

capabilitiesobject

Session tokens only. The environment's resolved connections configuration — the same answer every server-side gate uses.

allow_configureboolean

Whether the widget may reopen an existing connection's post-connect form via POST /integrated-account/form-token.

allow_connectboolean

Whether the widget may start a new connection.

allow_deleteboolean

Whether the widget may remove a connection.

allow_multiple_per_integrationboolean

Whether one tenant may hold more than one account per integration.

allow_reauthboolean

Whether the widget may reconnect an existing account.

allow_refreshboolean

Whether the widget may refresh an account's credentials.

show_error_detailsboolean

Whether raw upstream error details are included in the widget's connection reads.

expires_atstring · date-time

Session tokens only. Moves forward on every renewal.

Example: 2026-07-28T11:45:00.000Z

idstring

The subject the credential resolves to — the tenant id when type is tenant, otherwise the API token id or the user id.

Example: acme-1

is_refreshableboolean

Session tokens only. Whether POST /session-token/renew will work.

Example: true

issued_atstring · date-time

Session tokens only. When the session was minted.

Example: 2026-07-28T11:30:00.000Z

issuerobject

Session tokens only. The credential that minted this session.

idstring · uuid

Example: 1ba1f401-7183-47c5-9e39-e8e257e3c795

typestring

Example: api_token

Possible values:

api_tokensession

layoutobject

Session tokens only. The environment's presentation defaults for the catalog. Not a security boundary — the SDK may override them per embed and the end user may change them in the widget's own toolbar — but they belong to the environment, so they arrive with the session rather than being guessed client-side.

default_group_bystring

How the catalog is grouped when it opens.

Possible values:

nonecategorystatus

default_viewstring

Which catalog layout the widget opens in.

Possible values:

cardslist

show_searchboolean

Whether the catalog's search box is shown. A catalog small enough not to need it hides the toolbar anyway.

max_lifetime_atstring · date-time

Session tokens only. Fixed at mint time.

Example: 2026-07-28T23:30:00.000Z

scopeobject

Session tokens only. What this session is confined to.

environment_idstring · uuid

Example: 8a2b104d-74a6-47f2-b93e-c6b611e82391

tenant_idstring

Example: acme-1

typestring

Which kind of credential this is. tenant is a session token minted by POST /session-token — the credential this resource is named for. api_token is an admin API key, and session is a signed-in dashboard user, neither of which is a session token in the sense used here. An integrated-account token never appears: it cannot reach this route at all (see the 403 below).

Example: tenant

Possible values:

tenantapi_tokensession

curl -X GET 'https://api.truto.one/session-token/me' \
  -H 'Authorization: Bearer <your_api_token>' \
  -H 'Content-Type: application/json'

const response = await fetch('https://api.truto.one/session-token/me', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer <your_api_token>',
    'Content-Type': 'application/json',
  },
});

const data = await response.json();
console.log(data);

import requests

url = "https://api.truto.one/session-token/me"
headers = {
    "Authorization": "Bearer <your_api_token>",
    "Content-Type": "application/json",
}
params = {
}

response = requests.get(url, headers=headers, params=params)
print(response.json())