> ## Documentation Index > Fetch the complete documentation index at: https://docs.flowpayroll.ai/llms.txt > Use this file to discover all available pages before exploring further. # Get yourself and your access > Who you are and every role you hold, in the same shape as `GET /users/{principalId}`: `access` lists each grant (the whole account, an organisation or an organisation group) with its role. Any signed-in person can read their own, whatever their role. API tokens are refused (403 `own_access_needs_a_person`); a token reads itself with `GET /api-tokens/{clientId}`. ## OpenAPI ````yaml /api-reference/specs/administration.json get /users/me openapi: 3.0.4 info: title: Administration API description: >- Manage your Flow Payroll account: the organisations it owns, the people who can sign in to it, the API tokens it holds, its brand, and a feed of recent administration activity. Every resource is scoped to the account your credentials belong to, so no request ever names a customer and the `X-Org-Id` header is not used. version: v1 servers: - url: https://api.sandbox.flowpayroll.ai/v1/administration security: - X-Auth-Token: [] tags: - name: Customer description: >- Your account: the customer every other resource on this API belongs to. Read it and rename it. - name: Organisations description: >- The organisations your account owns or manages: list them with headcounts and your access to each, get one in full, add one or several at a time, see everybody who can reach one, and read which of its data an outside system manages. - name: Organisation groups description: >- Named sets of your organisations, such as the clients one team looks after. Give a person or API token a group, and they reach every organisation in it, including ones added later. - name: Users description: >- The people who can sign in to your account: list, invite (one or many), resend invitations, and manage each person's direct grants and account-wide access. - name: Roles description: >- What people and API tokens can do where they have access: the built-in roles, roles of your own, and the default role. Only Administrator can be given today. - name: API tokens description: >- The client credentials your integrations authenticate with: create (the secret is shown once), rename, rotate, revoke, and manage which organisations each token reaches. - name: Branding description: >- Your white-label brand: edit a draft, publish it, upload its files, and set a company logo for each organisation. - name: Activity description: >- Recent administration actions in your account, and every change to who has access, newest first. - name: SCIM description: >- SCIM 2.0 provisioning: your identity provider adds, updates, suspends and removes your account's people, and gives them account-wide roles. paths: /users/me: get: tags: - Users summary: Get yourself and your access description: >- Who you are and every role you hold, in the same shape as `GET /users/{principalId}`: `access` lists each grant (the whole account, an organisation or an organisation group) with its role. Any signed-in person can read their own, whatever their role. API tokens are refused (403 `own_access_needs_a_person`); a token reads itself with `GET /api-tokens/{clientId}`. operationId: GetMe responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/UserDetailResponseResponseBody' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' components: schemas: UserDetailResponseResponseBody: type: object properties: message: $ref: '#/components/schemas/MessageWithTokenResponse' content: $ref: '#/components/schemas/UserDetailResponseContentResponse' validationIssues: type: array items: $ref: '#/components/schemas/ValidationIssue' nullable: true additionalProperties: false ObjectResponseBody: type: object properties: message: $ref: '#/components/schemas/MessageWithTokenResponse' content: $ref: '#/components/schemas/ObjectContentResponse' validationIssues: type: array items: $ref: '#/components/schemas/ValidationIssue' nullable: true additionalProperties: false MessageWithTokenResponse: type: object properties: text: type: string token: type: string tokenArguments: type: array items: $ref: '#/components/schemas/ValidationIssueArgument' nullable: true additionalProperties: false UserDetailResponseContentResponse: type: object properties: data: $ref: '#/components/schemas/UserDetailResponse' metadata: $ref: '#/components/schemas/ContentMetadataResponse' additionalProperties: false ValidationIssue: type: object properties: field: type: string reason: type: string reasonToken: type: string reasonTokenArguments: type: array items: $ref: '#/components/schemas/ValidationIssueArgument' nullable: true additionalProperties: false ObjectContentResponse: type: object properties: data: {} metadata: $ref: '#/components/schemas/ContentMetadataResponse' additionalProperties: false ValidationIssueArgument: type: object properties: name: type: string value: {} additionalProperties: false UserDetailResponse: type: object properties: user: $ref: '#/components/schemas/UserSummaryResponse' organisationIds: type: array items: type: string description: >- Deprecated: use `access`. Deprecated: use `access`. Every organisation they hold a direct grant on. deprecated: true coversWholeCustomer: type: boolean description: >- Deprecated: use `access`. Deprecated: use `access`. True when they also hold account-wide access, which reaches every organisation the account owns, including ones added later. When true, `organisationIds` is not the whole picture and is usually empty. deprecated: true access: type: array items: $ref: '#/components/schemas/AccessGrantResponse' description: >- Their grants in your account, in the shape `POST /users` takes: account-wide first, then each organisation group, then each organisation. A grant from before roles existed reads as `administrator`. additionalProperties: false description: 'One person in full: who they are, and everything they reach.' ContentMetadataResponse: type: object properties: dateFormat: type: string dateTimeFormat: type: string paginationToken: type: string nullable: true additionalProperties: false UserSummaryResponse: type: object properties: principalId: type: string description: >- The person's stable identifier on this platform. Address them with it on every `/users/{principalId}` route. email: type: string description: The address they sign in with. nullable: true givenName: type: string description: Their first name, as invited. nullable: true familyName: type: string description: Their last name, as invited. nullable: true accountState: enum: - unknown - invited - active - disabled type: string description: >- `invited` until they first sign in, `active` once they have, `disabled` when their sign-in has been switched off, and `unknown` when the identity directory could not be reached for this row. Somebody linked to an identity provider is `active` from the start: there is no invitation to accept. detailsAvailable: type: boolean description: >- False when the identity directory did not answer for this person. Their name and email address are then the last values stored and may be out of date or absent. The row is still returned. invitedDate: type: string description: When they were first given access to this account. nullable: true accessType: enum: - Customer - Guest type: string description: >- `Customer` for one of the account's own people; `Guest` for somebody from another business who reaches organisations here by invitation. A guest row shows only the access this account granted, and their account is not this account's to manage. signInProviders: type: array items: type: string description: >- The identity providers this person signs in through, by name. Empty or absent when they sign in with a password. nullable: true passwordSignIn: type: string description: >- `Denied` when they sign in through their identity provider alone: no temporary password was issued, the invitation cannot be resent, and there is nothing to reset. `Allowed` when they have a password. Absent on accounts created before sign-in was recorded. nullable: true additionalProperties: false description: One person in your account. AccessGrantResponse: type: object properties: scope: $ref: '#/components/schemas/AccessChangeScopeResponse' roleId: type: string description: The role there. additionalProperties: false description: >- One grant: a scope and the role it carries there, in the shape the create requests send it. The scope is the one the access-change history publishes, with `id` always filled (the account's own id on `Account`). AccessChangeScopeResponse: type: object properties: type: enum: - Organisation - OrganisationGroup - Account type: string description: >- `Organisation`, `OrganisationGroup` or `Account` (every organisation of the account). id: type: string description: The organisation, the organisation group or the account. additionalProperties: false description: What changed access reaches. securitySchemes: X-Auth-Token: type: apiKey description: FlowPayroll JWT (raw token, no Bearer prefix) name: X-Auth-Token in: header ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.