opschain whoami

Included from Basic tier

Show the identity the targeted server resolves for the stored token — the quick "who am I, against which server" check after opschain login or a context switch:

opschain whoami
Server: https://opschain.example.com
Identity: alice
Provider: local
Superuser: true

Provider names the identity provider the session's account belongs to (local or ldap). With a username deliberately held by both a directory and a local account — the break-glass shape — it is the only way to tell which identity a session holds. When /api/me reports them, a Break-glass: true line marks a session on a break-glass account, and a Directory shadowed: true line marks a local session whose username a directory identity also holds (that directory identity was not used); both lines are omitted when clear, and on servers predating the fields.

The target follows the usual precedence (--server, OPSCHAIN_SERVER, the active context). In local mode there is no server identity and the command says so (Context: local (local mode — no server identity)) and exits 0. -o json|yaml prints the server and the full identity document; on a server running without user authentication the identity reads as an unauthenticated principal.

Exit codes: 0 on success (including local mode), 1 when the server is unreachable or the stored token is rejected, 2 for a usage error.

See also

• opschain docs cli/login — store the token this command verifies.
• opschain docs cli/context — which server is being targeted.