GEThttps://api.veriko.mx/v1/users/me

Get the current user's complete information

Audience: public
Auth: API key
Permission: users:read_self

Returns in a single call everything the application needs to know about the authenticated user:

Their profile: identifier, email, name, role, status, timezone and language.
Their API key data: the prefix and the last 4 characters, never the key.
Their subscription, with the plan, the status and the end of the current period.
Two-factor authentication (2FA) state.
The role permissions, as a flat list of resource:action pairs.
The notifications summary: unread, push delivery and Telegram link.

The profile fields that only make sense in an interactive session — the phone, the last sign-in — are left out and served by GET /v1/users/me/profile-detail.

Request

cURLPython•JavaScript•PHP•

curl -X GET 'https://api.veriko.mx/v1/users/me' \
  -H 'Authorization: Bearer veriko_••••'

Python example — coming soon.

JavaScript example — coming soon.

PHP example — coming soon.

**Response 200**`UserMeBundle` — Complete information for the authenticated user.
Field	Type	Description
`id`	`string (uuid)`	Unique user identifier (UUID v4). e.g. `b1e4a2c3-1234-4abc-8def-000000000001`
`email`	`string (email)`	Email address tied to the user account: the one it signs in with and where its notifications arrive. e.g. `[email protected]`
`name`	`string`	Name the user is presented with in the interface. Up to 100 characters. e.g. `Carlos Lopez`
`role`	`string`	The user account's role in the organization. It decides what permissions its sessions carry — `owner`: It owns the account; `admin`: It administers it; `user`: It uses it. e.g. `user`
`status`	`string`	Account status. Only `active` allows API operations. `suspended`: Account suspended; `revoked`: Deleted by the user. e.g. `active`
`timezone`	`string`	IANA timezone the dates are presented to the user in. e.g. `America/Mexico_City`
`language`	`string \| null`nullable	Language the user account prefers for the interface and the notifications — `es`: Spanish; `en`: English; `null`: The user account has not chosen a preferred language yet. e.g. `es`
`email_verified_at`	`string \| null`nullable	Date and time when the email was verified, in ISO 8601 UTC. `null` when it is still pending. e.g. `2026-04-30T10:15:00Z`
`created_at`	`string (date-time)`	Date and time when the account was created, in ISO 8601 UTC. e.g. `2026-01-15T08:00:00Z`
`api_key`	`object \| null`nullable	The user account's API key data. It never carries the full key: for that there is `POST /v1/users/me/api-key/reveal`, which requires the password.
`prefix`	`string`	First 8 characters of the API key, which identify it without revealing it. e.g. `example_`
`last_4`	`string \| null`nullable	Last 4 characters of the API key, used to render it masked (`veriko_a1b2••••••f9c2`). `null` for accounts predating that field, until it is backfilled. e.g. `f9c2`
`subscription`	`object \| null`nullable	The user account's active subscription. When there is none, it carries the values of the system default plan, and it is `null` only when it could not be read — the case `_warnings` reports.
`plan_slug`	`string`	Unique, human-readable plan identifier. e.g. `pro`
`plan_name`	`string \| null`nullable	Display name of the active plan, as the plan catalog shows it. It is `null` when the catalog could not be read. e.g. `Pro`
`status`	`string`	Current subscription status per the billing cycle. `active`: Up to date; `trialing`: In trial; `past_due`: A charge is outstanding; `canceled`: Cancelled; `paused`: Paused. e.g. `active`
`current_period_end`	`string \| null`nullable	Date and time when the current billing period ends, in ISO 8601 UTC. e.g. `2026-06-15T00:00:00Z`
`cancel_at`	`string \| null`nullable	Date and time of the scheduled cancellation, in ISO 8601 UTC. `null` when none is pending. e.g. `null`
`billing_interval`	`string \| null`nullable	Billing cadence — `once`: One cycle with no automatic renewal; `month`: Monthly; `year`: Yearly. e.g. `month`
`two_factor`	`object`	Two-factor authentication (2FA) state.
`enabled`	`boolean`	`true` when two-factor authentication (2FA) is active on the user account. e.g. `false`
`method`	`string \| null`nullable	Channel the authentication code (OTP) is delivered through — `sms`: By text message; `email`: By email; `null`: The user account never configured it. Disabling 2FA keeps the last channel used. e.g. `sms`
`last_used_at`	`string \| null`nullable	Date and time of the last 2FA use, in ISO 8601 UTC. A field planned for later: today it is always `null`. e.g. `null`
`permissions`	`array`	Flat list of the user's role permissions in `resource:action` format.
`notifications`	`object`	Summary of the user's notification queue.
`unread_count`	`integer`	Number of notifications that are neither read nor archived. e.g. `3`
`push_enabled`	`boolean`	`true` when the account has at least one active push subscription. e.g. `false`
`telegram_linked`	`boolean`	`true` when the account has a linked Telegram chat. e.g. `false`
`legal_accepted`	`boolean`	`true` when no document is left pending: neither the Terms of Service nor the Privacy Notice. `false` when the acceptance of either is missing, or when the team required acceptance of a version that the account has not accepted yet. Gates the post-login consent modal, which lists what is pending in `GET /users/me/legal/pending`. e.g. `true`
`_warnings`	`array`	Pieces that could not be computed while assembling the response. It only appears when one failed, and the fields that depended on it arrive at their empty value (`null` or an empty list). e.g. `["subscription_unavailable"]`

**Response status codes**`GET /v1/users/me`
Status	Class	Description	Body
200	`2xx`	Complete information for the authenticated user.	`UserMeBundle`
401	`4xx`	Authentication is required or the provided credentials are invalid.	`ErrorResponse`

**Errors from `GET /v1/users/me`**
Status	Code	Example
401	`unauthorized`	Invalid or missing authentication credentials. Envelope meta.request_id `c4d5e6f7a8b99b8a7f6e5d4c`