> ## Documentation Index
> Fetch the complete documentation index at: https://docs.twinbay.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Read the authenticated user

> Returns the caller, the organization their token acts in, and every organization they belong to with their role in each. A caller who has not joined an organization yet gets a null active organization, which is how the client knows to show onboarding.



## OpenAPI

````yaml https://api.twinbay.ai/openapi.json get /users/me
openapi: 3.1.0
info:
  title: Twinbay
  description: Backend API
  version: 0.1.0
servers:
  - url: https://api.twinbay.ai
    description: Production
security: []
tags:
  - name: healthchecks
    description: Healthcheck endpoints
  - name: users
    description: >-
      The current user. Sign-up and sign-in happen in WorkOS AuthKit, which
      issues the access tokens this API accepts.
  - name: organizations
    description: >-
      Organizations the caller belongs to. Every authenticated request acts
      inside exactly one organization — the one its access token names — so
      these routes address it as `current`.
  - name: api-keys
    description: >-
      Long-lived credentials for callers that cannot hold an AuthKit session —
      agents, SDKs, CI. A key is accepted wherever an access token is, and acts
      with the role its creator holds when the request arrives.
  - name: sandboxes
    description: >-
      Create and edit isolated provider sandboxes. Each sandbox contains
      behavioural twins from the `twins` package.
  - name: twins
    description: Browse the digital twins available for new sandboxes.
paths:
  /users/me:
    get:
      tags:
        - users
      summary: Read the authenticated user
      description: >-
        Returns the caller, the organization their token acts in, and every
        organization they belong to with their role in each. A caller who has
        not joined an organization yet gets a null active organization, which is
        how the client knows to show onboarding.
      operationId: read_me
      responses:
        '200':
          description: The caller and their memberships
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MeResponse'
        '401':
          description: The credential is missing, malformed, expired, or not trusted
        '403':
          description: The token names an organization with a role we do not model
      security:
        - Access token: []
        - Organization API key: []
components:
  schemas:
    MeResponse:
      properties:
        user:
          $ref: '#/components/schemas/UserResponse'
        active_organization_id:
          anyOf:
            - type: string
              format: uuid
            - type: 'null'
          title: Active Organization Id
          description: >-
            Organization the access token in use is scoped to, or null while the
            caller has not joined one yet
        memberships:
          items:
            $ref: '#/components/schemas/MembershipResponse'
          type: array
          title: Memberships
          description: Every organization the caller belongs to, with their role
      type: object
      required:
        - user
        - active_organization_id
        - memberships
      title: MeResponse
    UserResponse:
      properties:
        id:
          type: string
          format: uuid
          title: Id
        email:
          type: string
          format: email
          title: Email
        first_name:
          type: string
          title: First Name
        last_name:
          type: string
          title: Last Name
      type: object
      required:
        - id
        - email
        - first_name
        - last_name
      title: UserResponse
    MembershipResponse:
      properties:
        organization:
          $ref: '#/components/schemas/OrganizationResponse'
        role:
          $ref: '#/components/schemas/OrganizationRole'
          description: The caller's role in this organization
      type: object
      required:
        - organization
        - role
      title: MembershipResponse
    OrganizationResponse:
      properties:
        id:
          type: string
          format: uuid
          title: Id
        workos_organization_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Workos Organization Id
          description: >-
            WorkOS id of this organization. Clients need it to ask AuthKit for a
            token that acts here.
        name:
          type: string
          title: Name
        created_at:
          type: string
          format: date-time
          title: Created At
      type: object
      required:
        - id
        - workos_organization_id
        - name
        - created_at
      title: OrganizationResponse
    OrganizationRole:
      type: string
      enum:
        - admin
        - member
      title: OrganizationRole
  securitySchemes:
    Access token:
      type: http
      description: Access token issued by WorkOS AuthKit.
      scheme: bearer
    Organization API key:
      type: apiKey
      description: >-
        An organization API key, as minted by POST
        /organizations/current/api-keys.
      in: header
      name: X-API-Key

````