Get the calling user's account

GET/account

Returns the user the token belongs to: name, email, username, status, user type, organisation, the permissions the user holds, and the profile image address (null when there is none). It never returns a session key or the stored file key. Only a token with an acting user can read it, so an organisation (service identity) token cannot hold the scope. Changes nothing.

Responses

200

The account.

Account

{
  "data": {
    "id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
    "name": "string",
    "email": "string",
    "username": "string",
    "status": "string",
    "user_type": "string",
    "organisation": {
      "id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
      "name": "string"
    },
    "profile_image_url": "string",
    "permissions": [
      "string"
    ],
    "created_at": "2026-06-12T10:00:00+00:00"
  }
}

401

Authentication failed. error.code is one of invalid_token, expired, revoked.

Error

403

Authorization failed. error.code is one of org_disabled, ip_blocked, missing_scope, scope_disabled, user_disabled.

Error

404

Resource not found (error.code = not_found).

Error

429

Rate limit exceeded (error.code = rate_limited).

Error

Examples

curl https://your-org-domain/kong/core/api/v2/account\
  -H "Authorization: Bearer $HELM_API_KEY"\
  -H "Content-Type: application/json"