GET `/api/v1/me`

Who the token acts as: user or service account, firm, role, privileges, scopes.

Any valid token
operationId metaMe

Who the token acts as: a person or a service account, the firm, the role, the effective privileges and the token's scopes, how it was obtained and when it expires. Call it first to check a new token: a 401 means the token is missing, wrong or expired.

Request

GET /api/v1/me

Headers

Header	Required	Value
`Authorization`	yes	`Bearer <token>`: an OAuth access token (`vat_…`) or a personal access token (`vpt_…`). Get a token

Examples

Keep the token in an environment variable (VESTORIS_TOKEN), never in the script.

curl

curl "https://vestoris.com/api/v1/me" \
  -H "Authorization: Bearer $VESTORIS_TOKEN"

Python (requests)

import os, requests

r = requests.get(
    "https://vestoris.com/api/v1/me",
    headers={
        "Authorization": f"Bearer {os.environ['VESTORIS_TOKEN']}",
    },
    timeout=30,
)
r.raise_for_status()  # errors are application/problem+json with a stable "code"
print(r.json())

JavaScript (fetch)

const res = await fetch("https://vestoris.com/api/v1/me", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.VESTORIS_TOKEN}`,
  },
});
const data = await res.json();
if (!res.ok) throw new Error(`${data.code}: ${data.detail}`); // problem+json
console.log(data);

Response

200 OK, application/json: Me. Rate-limit headers: RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset.

Response fields

Field	Type	Description
`id`	id (string)	The record's id (a string of digits).
`kind`	string	"person" or "service".
`name`	string	The person or service account.
`role`	string	The role.
`firm`	object	The firm.
`firm.id`	id (string)	The record's id (a string of digits).
`firm.name`	string	The person or service account.
`firm.demo`	boolean	Demo.
`privileges`	list of string	Effective privileges.
`scopes`	list of string	The token's scopes.
`grant`	string	How the token was obtained: client_credentials, authorization_code or personal.
`client_id`	string or null	The OAuth client id behind the token (null for personal access tokens).
`token_expires_at`	date-time or null	When the token expires.
`paper_trading`	string	A reminder that orders and fills are simulated.

Example response

HTTP/1.1 200 OK
Content-Type: application/json

{
    "id": "9",
    "kind": "person",
    "name": "Alex Rivera",
    "role": "portfolio_manager",
    "firm": {
        "id": "1042",
        "name": "Alex Rivera",
        "demo": true
    },
    "privileges": [
        "use_pipeline",
        "draft_rules",
        "export"
    ],
    "scopes": [
        "reference:read",
        "portfolio:read",
        "orders:read",
        "orders:write"
    ],
    "grant": "personal",
    "client_id": null,
    "token_expires_at": "2026-10-27T14:30:00Z",
    "paper_trading": "Simulated orders and fills only. Not investment advice."
}

Example values. Your values depend on your firm's data; prices, orders and fills are simulated.

Status codes and errors

Errors are application/problem+json (RFC 9457) with a stable code to program against; the detail says what to fix. See Errors.

Status	When	Problem codes
200	Success
400	The request is malformed	`invalid_request`
401	No token, or it is invalid or expired	`invalid_token`
403	The token lacks the scope, or the person or service account behind it lacks the privilege or account permission	`insufficient_scope` `forbidden` `ip_not_allowed`
429	Rate limited: wait for Retry-After seconds	`rate_limited`

{
    "type": "https://vestoris.com/developers/errors#validation_failed",
    "title": "Validation failed",
    "status": 422,
    "detail": "Quantity must be greater than zero.",
    "code": "validation_failed",
    "instance": "/api/v1/me"
}

On the screens

The same thing in the app is explained in: