Checking your credentials

GET /v1/whoami describes the caller. Make it your first call when setting up an integration, and your first call when one stops working.

curl -s -H "Authorization: Bearer $ACCESS_TOKEN" \
  https://api.secutec.com/v1/whoami

{
  "organization": { "id": "a17c...", "name": "Acme BV", "alias": "acme" },
  "client_id": "ext-api-a17c...",
  "permissions": ["read", "write"],
  "token_expires_at": "2026-09-15T09:12:41Z",
  "rate_limit": { "burst_per_second": 10, "sustained_per_hour": 5000 }
}

Why it is worth calling

It makes no call to anything else. Every other endpoint reaches further into the platform, so when one of them fails you cannot tell a credentials problem from an outage on our side. whoami answers from your token alone:

• whoami works, another endpoint fails — your credentials are fine and the problem is ours. Retry; if it persists, contact support with the x-request-id from the failing response.
• whoami itself fails — the problem is the credential. See the table below.

It tells you which tenant you are reading. Every response is filtered to your organization. Pointing a pipeline at the wrong one produces missing data, not an error, so there is no other way to catch it.

It tells you what you may do. permissions contains read, and write when your account may change threat status or notes.

It reports your real rate limits. The documented defaults are not necessarily yours — an override moves them, and rate_limit shows what is actually applied.

When it fails

Status	type	What to do
401	auth/missing-token	No Authorization header arrived. Check your client is attaching it — this is the most common setup mistake.
401	auth/invalid-token	The token did not verify. Usually a token from the wrong environment.
401	auth/expired-token	Tokens last five minutes. Request a new one with the same credentials.
403	auth/insufficient-role	The credential is valid but not entitled to this API. Contact your Secutec representative.

Using it as a connection test

If your SIEM or SOAR platform has a "test connection" action, point it here. Some platforms treat any HTTP response as a successful action, including a 401 — so a broken integration can look healthy. A test against whoami gives you a body you can assert on: check that organization.id is the tenant you expect.