Current user bootstrap payload
/user/me
The profile of whoever the credential belongs to, plus one entry per organization they are an active member of, each carrying that org's roles, teams and effective permissions. Call this first: it is how a client learns which organization ids it may put in `X-Organization-Id` and which actions to offer. With an org API token this still returns the token owner's memberships, so read `organizations` rather than assuming the token's org is the only one.
Response Body
User id (usr_…).
Login identities linked to this account.
e.g. google, email_code, invite, or an SSO connection.
Inactive accounts cannot authenticate at all.
Platform staff who are also a member of the root organization — gates the staff console.
Platform staff flag. Unrelated to organization roles.
True when TOTP is active on this account.
One entry per active membership. Organizations where membership has lapsed are omitted.
Membership facts only — roles and teams are the sibling fields below, not nested here.
4 properties
User id (usr_…).
How they joined, e.g. invite or verified domain.
15 properties
Whether the CALLER may delete this organization — the org:delete permission, which only the Org Owner role holds, and never for the platform root organization. Server-computed: branch on this rather than inspecting roles. Always false where the response has no member context to compute it from — the org switcher list GET /organization (one member-context lookup per row would be a per-row round trip), the staff console, and the invite-accept response. It never overstates: trust it when true, and read GET /user/me or GET /organization/{id} (both of which compute it) when you need it for a list row.
Whether the CALLER may cancel a scheduled deletion: the org:manage permission, and only while purge_after is still ahead. Server-computed, like can_delete, and false for the same reasons — no member context (the org switcher list, the staff console) — plus once the window has closed. Read purge_after to tell "too late" from "not yours to undo".
Set when a deletion has been scheduled (DELETE /organization/{id}). The organization is read-only until purge_after. Null otherwise.
Organization id (org_…) — the value for X-Organization-Id.
Public URL of the logo image, or null.
The stored plan: gold, black, or none when locked. This is not the same as the effective entitlement — read GET /organization/{id}/entitlements before gating a feature on it.
When a scheduled deletion becomes permanent — 30 days after deletion_scheduled_at. Null unless scheduled.
Data location fixed at creation: us/eu pin a hard jurisdiction, apac is a placement hint.
Free-form org settings. PATCH /organization/{id} REPLACES this object wholesale.
Immutable after creation.
When staff granted an indefinite trial, or null. Unlocked with no end date: no countdown, no expiry email, billing still reachable.
Effective permission names, unioned across roles. This is the authoritative list for deciding what to show; the server re-checks it on every request.
Role summaries held in this organization.
4 properties
Role id (role_…).
billablefree_admin
2 properties
Team id (team_…).
curl -X GET 'https://api.elaichi.ai/user/me' \
-H 'Authorization: Bearer $ELAICHI_API_TOKEN' \
-H 'Content-Type: application/json'const response = await fetch('https://api.elaichi.ai/user/me', {
method: 'GET',
headers: {
'Authorization': 'Bearer ' + process.env.ELAICHI_API_TOKEN,
'Content-Type': 'application/json',
},
});
const data = await response.json();
console.log(data);import os
import requests
url = "https://api.elaichi.ai/user/me"
headers = {
"Authorization": f"Bearer {os.environ['ELAICHI_API_TOKEN']}",
"Content-Type": "application/json",
}
response = requests.get(url, headers=headers)
print(response.json())