---
title: "Identify"
method: GET
path: "/v2/self"
tags: ["Meta"]
---

# Identify

`GET /v2/self`

Identify the current access token, the workspace it is linked to, and any permissions it has.

Every kind of Attio access token can be introspected:

- **Workspace access tokens**, created from a workspace's settings. These have no OAuth client, so `client_id` and `aud` contain the workspace access token's own ID.
- **OAuth access tokens**, granted to an app through the OAuth 2.0 authorization code flow. `client_id` and `aud` contain the app ID.
- **App access tokens**, issued to an app installation and exposed to that app's server functions as `ATTIO_API_TOKEN`. `client_id` and `aud` contain the app ID.

Per [RFC 7662](https://www.rfc-editor.org/rfc/rfc7662), `active` is the only member guaranteed to be present. `exp` is always `null`, because Attio access tokens do not currently expire.
All other members are optional, and are omitted rather than returned as `null` when they are not present.

Unknown, revoked, and deleted tokens are not treated as an error. They return `200` with `{"active": false}` and no other members.

## Response `200`

Success

- union
  - object
    - `active` false, required
  - object
    - `active` true, required — Whether the token is currently active and usable.
    - `scope` string, required — A space-separated list of scopes associated with this token
    - `client_id` string, required — Identifies the client the token was issued to. For app access tokens this is the app ID. Workspace access tokens have no OAuth client, so this is the workspace access token ID.
    - `token_type` 'Bearer', required — The type of token, always Bearer.
    - `exp` number, nullable, required — The time at which this token will expire, if set, as a number of seconds since January 1 1970 UTC. Attio access tokens do not currently expire, so this is always null.
    - `iat` number, required — The time at which this token was issued, as a number of seconds since January 1 1970 UTC.
    - `sub` string, uuid, required — Since Bearer tokens grant Workspace-level permissions, this property contains the workspace_id.
    - `aud` string, required — The intended audience for this token, for Bearer tokens this is the same as the client_id.
    - `iss` 'attio.com', required — The issuer of the token. Always attio.com
    - `authorized_by_workspace_member_id` string, uuid — The ID of the workspace member who authorized this token initially. Almost every token has one, but it is omitted for the app access tokens that Attio created itself rather than on a member's behalf.
    - `workspace_id` string, uuid, required — The ID of the workspace the token is scoped to.
    - `workspace_name` string, required — The name of the workspace the token is scoped to.
    - `workspace_slug` string, required — The slug of the workspace the token is scoped to.
    - `workspace_logo_url` string, uri, nullable, required — The logo URL of the workspace the token is scoped to.

---

[API](https://skmtc.net/attio/apis/attio-api.md) · [All operations](https://skmtc.net/attio/apis/attio-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/attio/attio-api/versions/40a8e41d06a2/schema)