# Check your token

`GET https://api.mailmasker.org/api/v1/auth/introspect`

Who a token belongs to, when it runs out, and the account's roles.

- Who can use it: Any signed-in account
- Area: Sign-in and tokens
- Answers 200 OK when it works
- Page: https://developer.mailmasker.org/check-token

Answers only while the token still works: it hasn't run out, and its session hasn't been ended. `exp` is when it runs out, in seconds since 1970 (UTC). `jti` is the id of its session, as your session list shows it.

## Parameters

| Name | In | Required | What it is | Example |
|---|---|---|---|---|
| `capability` | query | no | A permission name, such as audit.view. The answer then also says, as `has_capability`, whether the account holds it. Site admins hold every permission. |  |

## Good to know

- A missing, run-out or signed-out token answers 401.

## Examples

cURL:

```bash
curl -s 'https://api.mailmasker.org/api/v1/auth/introspect' \
  -H "Authorization: Bearer $TOKEN"
```

Perl:

```perl
use Mojo::Base -strict;
use Mojo::UserAgent;

my $ua  = Mojo::UserAgent->new;
my $res = $ua->get('https://api.mailmasker.org/api/v1/auth/introspect',
    { Authorization => "Bearer $ENV{TOKEN}" })->result;
die $res->code, ' ', ($res->json('/error') // $res->message), "\n" unless $res->is_success;
print $res->body, "\n";
```

homelab-cli:

```bash
homelab-cli whoami
```

## Response

200 OK:

```json
{
  "email": "you@example.com",
  "exp": 1793850130,
  "roles": ["user"],
  "jti": "7d3f7d3f7d3f7d3f7d3f7d3f7d3f7d3f7d3f7d3f7d3f7d3f7d3f7d3f7d3f7d3f"
}
```