curl --request GET \
--url https://api.citadel.example/api/v1/me \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.citadel.example/api/v1/me', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.citadel.example/api/v1/me"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.citadel.example/api/v1/me"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"organization": {
"id": "0199a3a0-0a1b-7c2d-8e3f-4a5b6c7d8e9f",
"name": "Acme"
},
"key": {
"id": "0199a3a1-1b2c-7d3e-9f4a-5b6c7d8e9f0a",
"name": "payouts-backend",
"prefix": "ctd_a1b2c3",
"scopes": [
"read",
"transactions.write"
],
"vaults": [
"0199a3b0-1a2b-7c3d-8e4f-5a6b7c8d9e0f"
],
"ip_allowlist": [
"203.0.113.0/24"
],
"expires_at": "2027-01-05T09:00:00Z",
"created_at": "2026-10-07T09:00:00Z"
},
"networks": [
"mainnet"
],
"remote_ip": "203.0.113.17"
}Get the calling key
What the key you call with is: the organization it acts for, what it was minted with (scopes, vaults, IP allowlist, expiry), the networks your installation serves, and the address your call arrived from — the one the IP allowlist judges. Use it to check an integration end to end. The token itself is never returned: Citadel keeps only its digest.
Takes no network. Needs the read scope, like every GET.
curl --request GET \
--url https://api.citadel.example/api/v1/me \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.citadel.example/api/v1/me', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.citadel.example/api/v1/me"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.citadel.example/api/v1/me"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"organization": {
"id": "0199a3a0-0a1b-7c2d-8e3f-4a5b6c7d8e9f",
"name": "Acme"
},
"key": {
"id": "0199a3a1-1b2c-7d3e-9f4a-5b6c7d8e9f0a",
"name": "payouts-backend",
"prefix": "ctd_a1b2c3",
"scopes": [
"read",
"transactions.write"
],
"vaults": [
"0199a3b0-1a2b-7c3d-8e4f-5a6b7c8d9e0f"
],
"ip_allowlist": [
"203.0.113.0/24"
],
"expires_at": "2027-01-05T09:00:00Z",
"created_at": "2026-10-07T09:00:00Z"
},
"networks": [
"mainnet"
],
"remote_ip": "203.0.113.17"
}Authorizations
An API key minted in the console (ctd_…). Authenticates; never authorizes funds. A key
carries scopes (read, wallets.write, transactions.write, events.write,
webhooks.write, policy.write) and may be limited to vaults, to IP addresses, and in
lifetime — see Authentication.
Response
The calling key.
Show child attributes
Show child attributes
Show child attributes
Show child attributes
The networks your installation serves.
The network the data lives on. Required wherever it appears in a request — there is no
default network. One your installation does not serve: 422 network_not_served.
mainnet, testnet The address this call arrived from: the one the IP allowlist judges.