API reference

Identity

Verify an API key and see which account and scopes it carries.

Import the whole API:OpenAPI 3.1 Postman collection

Call GET /v1/me first when you set up an integration or rotate a key. It confirms that the key works and tells you which account it belongs to and which scopes it holds. The endpoint itself needs no scope.

For the account’s plan, license usage and tag labels, use Retrieve the account, which requires account:read.

The me object

Identity of the calling API key and the account that owns it.

AttributeDescription

object string: Always me.
account object: The WeGuard account the key belongs to. A key can only read this account’s data.
account.id string: Account id.
account.name stringnullable: Company name of the account.
apiKey object: The key used for this request. The secret is never returned.
apiKey.id string: Unique id of the API key record (24 hex characters). This is not the <keyId> part of the key. To match the key shown in the console, use prefix.
apiKey.name string: Label given to the key when it was created.
apiKey.prefix string: Public, non-secret part of the key: wgk_<keyId>. Safe to log.
apiKey.scopes array of strings: Scopes granted to the key, sorted. See Authorization.
apiKey.createdAt timestamp: When the key was created.
apiKey.expiresAt timestampnullable: When the key expires. null if it never expires.

Example

{
  "object": "me",
  "account": {
    "id": "5f1d7c0e9b1e8a3f2c4d6e8a",
    "name": "Acme Logistics"
  },
  "apiKey": {
    "id": "6701a2b3c4d5e6f708192a3b",
    "name": "CMDB sync",
    "prefix": "wgk_1a2b3c4d5e6f7a8b",
    "scopes": [
      "devices:read"
    ],
    "createdAt": "2026-10-01T10:00:00Z",
    "expiresAt": "2026-12-30T10:00:00Z"
  }
}

Retrieve the calling key

GET/v1/me

No scope required. Any valid API key can call this endpoint.

Returns the API key used for the request and the account that owns it. Any valid key can call this endpoint. No scope is required, and the endpoint takes no parameters.

Example request

curl https://api-gw.weguard.ai/core/v1/me \
  -H "Authorization: Bearer $WEGUARD_API_KEY"

const response = await fetch("https://api-gw.weguard.ai/core/v1/me", {
  headers: { Authorization: `Bearer ${process.env.WEGUARD_API_KEY}` },
});

const body = await response.json();
if (!response.ok) {
  throw new Error(`${body.code}: ${body.detail} (requestId ${body.requestId})`);
}
console.log(body);

import os
import requests

response = requests.get(
    "https://api-gw.weguard.ai/core/v1/me",
    headers={"Authorization": f"Bearer {os.environ['WEGUARD_API_KEY']}"},
    timeout=30,
)
response.raise_for_status()
print(response.json())

Response

Returns a me object.

200 OK

{
  "object": "me",
  "account": {
    "id": "5f1d7c0e9b1e8a3f2c4d6e8a",
    "name": "Acme Logistics"
  },
  "apiKey": {
    "id": "6701a2b3c4d5e6f708192a3b",
    "name": "CMDB sync",
    "prefix": "wgk_1a2b3c4d5e6f7a8b",
    "scopes": [
      "devices:read"
    ],
    "createdAt": "2026-10-01T10:00:00Z",
    "expiresAt": "2026-12-30T10:00:00Z"
  }
}

Errors

400unknown_parameter
The request includes a query parameter. This endpoint takes none.

Common errors

Besides the errors listed for each endpoint, any request can fail authentication, exceed the rate limit, ask for a format other than JSON, or fail with a server error. See Errors for the response format and retry guidance.

401missing_credentials
The request has no Authorization header.
401invalid_authorization_header
The Authorization header does not use the Bearer scheme, or has no key after it. The WWW-Authenticate header carries error="invalid_request".
401invalid_api_key
The key is malformed, does not exist, or its secret does not match. The WWW-Authenticate header carries error="invalid_token".
401api_key_expired
The key is past its expiresAt.
401api_key_revoked
An account admin revoked the key. Revocation takes effect immediately and cannot be undone.
403account_inactive
The WeGuard account that owns the key has been deleted or disabled.
406not_acceptable
The Accept header excludes JSON.
429rate_limit_exceeded
The key has used up its request budget. See Rate limits.
500internal_error
An unexpected error occurred on our side.
503service_unavailable
A service WeGuard depends on is temporarily unavailable, or reading the data took longer than the time WeGuard allows for it. This can also happen while your key is being checked, so it can be returned before authentication completes. The response carries Retry-After.