---
title: "The user behind the credential, and the credential itself"
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.gitpando.com/llms.txt
> Use this file to discover all available pages before exploring further.

Path: Pando API › users

`GET /v1/user`

## Authentication

Requires one of the following:

- `credential`, http, header `Authorization`
- `session`, apiKey, in cookie

## Code samples

### cURL

```curl
curl --request GET \
  --url https://app.gitpando.com/v1/user \
  --header 'Authorization: Bearer <token>'
```

### TypeScript

```typescript
const url = 'https://app.gitpando.com/v1/user';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch(url, options)
  .then(res => res.json())
  .then(json => console.log(json))
  .catch(err => console.error(err));
```

### Python

```python
import requests

url = "https://app.gitpando.com/v1/user"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)
```

## Responses

### 200

OK

#### Example

```json
{
  "login": "string",
  "name": "string",
  "email": "string",
  "picture_url": "string",
  "created_at": "2019-08-24T14:15:22Z",
  "credential": {
    "id": "string",
    "name": "string",
    "kind": "machine",
    "created_at": "2019-08-24T14:15:22Z",
    "last_used_at": "2019-08-24T14:15:22Z",
    "expires_at": "2019-08-24T14:15:22Z"
  }
}
```

- `me.response.200.login` (string, required)
- `me.response.200.name` (string | null, required)
- `me.response.200.email` (string | null, required)
- `me.response.200.picture_url` (string | null, required) — Their WorkOS profile picture (an https URL of at most 2,048 characters), stored at each sign-in, browser or `pando login`, and refreshed every time (a removed picture becomes null). Null when there is none or it is not https: the web draws one. Pando never fetches, proxies or caches it.
- `me.response.200.created_at` (string, required)
  - format `date-time`
- `me.response.200.credential` (object, required)
  - `me.response.200.credential.id` (string, required)
  - `me.response.200.credential.name` (string, required)
  - `me.response.200.credential.kind` (string, required)
    - one of `"machine"`, `"sandbox"`, `"bootstrap"`, `"browser"`
  - `me.response.200.credential.created_at` (string, required)
    - format `date-time`
  - `me.response.200.credential.last_used_at` (string | null, optional)
    - format `date-time`
  - `me.response.200.credential.expires_at` (string | null, optional) — Browser sessions only: the end unless used before then (each use pushes it to 30 days).
    - format `date-time`

### 401

An error

#### Example

```json
{
  "error": {
    "code": "string",
    "message": "string",
    "paths": [
      "string"
    ],
    "checks": {
      "sha": "string",
      "state": "success",
      "required": [
        "string"
      ],
      "checks_unknown": "string",
      "missing": [
        "string"
      ],
      "statuses": [
        {
          "sha": "string",
          "context": "string",
          "state": "pending",
          "target_url": "string",
          "description": "string",
          "creator": "string",
          "app": "string",
          "created_at": "2019-08-24T14:15:22Z"
        }
      ]
    }
  }
}
```

- `me.response.401.error` (object, required)
  - `me.response.401.error.code` (string, required)
  - `me.response.401.error.message` (string, required)
  - `me.response.401.error.paths` (array<string>, optional)
  - `me.response.401.error.checks` (object, optional) — GitHub's combined status, plus the required contexts and which are missing.
    - `me.response.401.error.checks.sha` (string | null, required)
    - `me.response.401.error.checks.state` (string, required) — `success` when the merge gate passes; `missing` when a required context has not reported; `unknown` while the required checks are (an unforced merge is refused).
      - one of `"success"`, `"pending"`, `"failure"`, `"error"`, `"missing"`, `"unknown"`
    - `me.response.401.error.checks.required` (array | null, required) — Null while unknown.
    - `me.response.401.error.checks.checks_unknown` (string | null, required) — Why the required checks are unknown, in plain words: "Pando couldn't read this monorepo's required checks; try again", or "pando.toml line 3: expected comma or end of structure; fix it on main, or merge with force". Null otherwise.
    - `me.response.401.error.checks.statuses` (array<object>, required) — The latest status per context.
      - `me.response.401.error.checks.statuses.sha` (string, required)
      - `me.response.401.error.checks.statuses.context` (string, required)
      - `me.response.401.error.checks.statuses.state` (string, required)
        - one of `"pending"`, `"success"`, `"failure"`, `"error"`
      - `me.response.401.error.checks.statuses.created_at` (string, required)
        - format `date-time`
      - `me.response.401.error.checks.statuses.target_url` (string | null, optional)
      - `me.response.401.error.checks.statuses.description` (string | null, optional)
      - `me.response.401.error.checks.statuses.creator` (string, optional) — The member who posted it (a login); `app:<slug>` for a status posted with a status token or by a CI integration; `hook:<hook id>` for a status token from a web hook with no app.
      - `me.response.401.error.checks.statuses.app` (string | null, optional) — The CI service that reported it (`buildkite`, `github-actions`, ...), stamped by Pando from a status token or a CI integration, never from the body or `target_url`. Null when a member posted it with their own credential. The web shows the service's mark for a slug it knows.
    - `me.response.401.error.checks.missing` (array<string>, optional)


Source: https://docs.gitpando.com/api/users/me/index.md