> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gobare.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Check the access token

> Check the access token and report what it may do.



## OpenAPI

````yaml /openapi.json get /v1/health
openapi: 3.1.0
info:
  title: Gobare Agent API
  version: v1
  description: >-
    Programmatic access to Gobare coding-agent sessions. Conceptually aligned
    with OpenAI's Agents API; deliberately not wire-compatible with it. See the
    divergence list in the product documentation.
servers:
  - url: https://api.{domain}
    variables:
      domain:
        default: gobare.dev
security: []
paths:
  /v1/health:
    get:
      summary: Check the access token
      description: Check the access token and report what it may do.
      operationId: get_health
      responses:
        '200':
          description: Check the access token and report what it may do.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Health'
        '400':
          description: >-
            `invalid_request`. A query parameter this endpoint does not take.
            Refused rather than ignored, because an ignored filter answers with
            everything and looks like a filter that matched.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: The access token is missing, unrecognised, expired or revoked.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: >-
            The token is valid but may not perform this call. The message names
            the scope it wanted.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: >-
            No such endpoint, or the public API is not enabled on this
            deployment.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: >-
            `rate_limit_exceeded`. The token is past its allowance for this
            bucket. Honour `Retry-After`; the `x-ratelimit-*` headers on every
            response say how close you were.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: An unexpected error. Quote the request id.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
        - accessToken: []
components:
  schemas:
    Health:
      type: object
      required:
        - object
        - status
        - version
        - scopes
        - usable
        - missing_scopes
      properties:
        object:
          type: string
          const: health
          description: >-
            Always `health`. Names the shape, so a value can be identified
            without knowing which call returned it.
        status:
          type: string
          const: ok
          description: >-
            Always `ok`, and structurally unable to be anything else — it
            reports that this deployment answered, which is all a health check
            can promise about itself. It is not a verdict on your token.
            `usable` is.
        version:
          type: string
          const: v1
        scopes:
          type: array
          items:
            type: string
            enum:
              - cli
              - sessions:read
              - sessions:write
              - tools:respond
              - artifacts:read
              - credentials:write
          description: What the presented token may do. Empty means it may do nothing here.
        usable:
          type: boolean
          description: >-
            Whether this token can do anything under /v1 at all. `false` for one
            holding only `cli`, which is a real token for `gobare pi import` and
            refused by every route here. That token reads
            `{"status":"ok","scopes":["cli"]}` and then 403s on the first real
            call — the signal was in `scopes` all along, but only for a caller
            who already knew what to compare it against.
        missing_scopes:
          type: array
          items:
            type: string
            enum:
              - cli
              - sessions:read
              - sessions:write
              - tools:respond
              - artifacts:read
              - credentials:write
          description: >-
            What to mint instead, named rather than inferred. Empty when
            `usable` is true.
    Error:
      type: object
      required:
        - error
      description: Every refusal this API makes, in one shape.
      properties:
        error:
          description: Always present on a failure, and the only thing present.
          type: object
          required:
            - code
            - message
            - request_id
          properties:
            code:
              type: string
              enum:
                - invalid_request
                - authentication_error
                - permission_denied
                - not_found
                - method_not_allowed
                - conflict
                - queue_full
                - rate_limit_exceeded
                - project_limit_exceeded
                - context_length_exceeded
                - provider_error
                - provider_unauthorized
                - sandbox_error
                - sandbox_unavailable
                - directory_unavailable
                - workspace_recovery_failed
                - bridge_incompatible
                - internal_error
            message:
              type: string
            request_id:
              type: string
              description: >-
                Also on the x-request-id header. Quote it when reporting a
                problem.
  securitySchemes:
    accessToken:
      type: http
      scheme: bearer
      description: >-
        A `gbr_pat_` access token. Scopes are recorded on the token when it is
        minted.

````