# Introspect the current token

> Source: https://truto.one/docs/api-reference/admin/session-tokens/me/

`GET /session-token/me`

Resource: **Session tokens**

## Response body

- **`type`** _(string)_
  Which kind of credential this is. `tenant` is a session token minted by `POST /session-token` — the credential this resource is named for. `api_token` is an admin API key, and `session` is a signed-in dashboard user, neither of which is a session token in the sense used here. An integrated-account token never appears: it cannot reach this route at all (see the `403` below).
  Allowed: `tenant`, `api_token`, `session`
- **`id`** _(string)_
  The subject the credential resolves to — the tenant id when `type` is `tenant`, otherwise the API token id or the user id.
- **`scope`** _(object)_
  Session tokens only. What this session is confined to.
  - **`tenant_id`** _(string)_
  - **`environment_id`** _(string)_
- **`issued_at`** _(string)_
  Session tokens only. When the session was minted.
- **`expires_at`** _(string)_
  Session tokens only. Moves forward on every renewal.
- **`max_lifetime_at`** _(string)_
  Session tokens only. Fixed at mint time.
- **`is_refreshable`** _(boolean)_
  Session tokens only. Whether `POST /session-token/renew` will work.
- **`issuer`** _(object)_
  Session tokens only. The credential that minted this session.
  - **`type`** _(string)_
    Allowed: `api_token`, `session`
  - **`id`** _(string)_
- **`allowed_origins_count`** _(integer)_
  Session tokens only. How many origins govern this session. The list itself is never returned. Zero means nothing may frame the widget.
- **`capabilities`** _(object)_
  Session tokens only. The environment's resolved connections configuration — the same answer every server-side gate uses.
  - **`allow_connect`** _(boolean)_
    Whether the widget may start a new connection.
  - **`allow_reauth`** _(boolean)_
    Whether the widget may reconnect an existing account.
  - **`allow_refresh`** _(boolean)_
    Whether the widget may refresh an account's credentials.
  - **`allow_delete`** _(boolean)_
    Whether the widget may remove a connection.
  - **`allow_multiple_per_integration`** _(boolean)_
    Whether one tenant may hold more than one account per integration.
  - **`show_error_details`** _(boolean)_
    Whether raw upstream error details are included in the widget's connection reads.
  - **`allow_configure`** _(boolean)_
    Whether the widget may reopen an existing connection's post-connect form via `POST /integrated-account/form-token`.
- **`layout`** _(object)_
  Session tokens only. The environment's presentation defaults for the catalog. Not a security boundary — the SDK may override them per embed and the end user may change them in the widget's own toolbar — but they belong to the environment, so they arrive with the session rather than being guessed client-side.
  - **`default_view`** _(string)_
    Which catalog layout the widget opens in.
    Allowed: `cards`, `list`
  - **`default_group_by`** _(string)_
    How the catalog is grouped when it opens.
    Allowed: `none`, `category`, `status`
  - **`show_search`** _(boolean)_
    Whether the catalog's search box is shown. A catalog small enough not to need it hides the toolbar anyway.

## Code examples

### curl

```bash
curl -X GET 'https://api.truto.one/session-token/me' \
  -H 'Authorization: Bearer <your_api_token>' \
  -H 'Content-Type: application/json'
```

### JavaScript

```javascript
const response = await fetch('https://api.truto.one/session-token/me', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer <your_api_token>',
    'Content-Type': 'application/json',
  },
});

const data = await response.json();
console.log(data);
```

### Python

```python
import requests

url = "https://api.truto.one/session-token/me"
headers = {
    "Authorization": "Bearer <your_api_token>",
    "Content-Type": "application/json",
}
params = {
}

response = requests.get(url, headers=headers, params=params)
print(response.json())
```