This authored guide describes the packaged CLI/MCP compatibility source preview.
It does not extend this site’s published OpenAPI projection. Additional REST
schema publication and matching-backend availability remain separate.The public CLI
0.2.0-beta.0 cohort includes bota auth status.
This endpoint and hosted get_project_identity still require a compatible
deployed backend. Client package delivery, endpoint/tool qualification and
docs-site promotion have separate release checks.GET /v1/auth/identity returns the authenticated project credential’s context.
Secret and restricted project keys can call it without a business-resource
scope. A restricted key with only devices:read, only integrations:read, or
an empty scope list can check its own identity without reading end users.
Device, upload, reset-completion and end-user credentials cannot use this
developer operation. Ordinary authentication, expiry/revocation, organization
quarantine and rate limits still apply. The successful response is not cached
(Cache-Control: no-store).
These are current credential facts. A listed scope does not bypass operation
ownership, feature, policy or billing checks. The response does not identify a
human Platform account or claim OAuth delegation, an expiry time, or access to
another project.
Use CLI status for terminal output. Hosted MCP exposes the
same fields through
get_project_identity; bota mcp --mode hosted discovers
that tool from a compatible backend. The default legacy local mode retains
its existing tool set.
An HTTP 401 means authentication failed. HTTP 403 means this credential tier
is not permitted, 423 means organization access is quarantined, and 429 means
the check is rate limited. A missing endpoint on an older backend, service
failure or malformed response does not establish that the key was revoked.
The CLI reports failure without falling back to an unrelated resource read.