feat(api-status): show account id of the token

Display the workspace_id from the /api_tokens/self response as
"Account ID" in both text and JSON output of `ggshield api-status`,
right below the API URL. Omitted when the api_tokens call fails.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: GG-HH

changelog.d/20260525_account_id_api_status.md

@@ -0,0 +1,3 @@
+### Added
+
+- `ggshield api-status` now displays the account ID (workspace ID) associated with the current token, in both text and JSON output.

doc/schemas/api-status.json

@@ -37,6 +37,10 @@
       "type": "array",
       "items": { "type": "string" },
       "description": "List of scopes granted to the current authentication token"
+    },
+    "account_id": {
+      "type": "integer",
+      "description": "Identifier of the workspace (account) the authentication token belongs to"
     }
   },
   "required": [

ggshield/cmd/status.py

@@ -33,9 +33,11 @@ def status_cmd(ctx: click.Context, **kwargs: Any) -> int:
         raise UnexpectedError("Unexpected health check response")
 
     token_scopes: Optional[List[str]] = None
+    account_id: Optional[int] = None
     token_response = client.api_tokens()
     if isinstance(token_response, APITokensResponse):
         token_scopes = token_response.scopes
+        account_id = token_response.workspace_id
 
     instance, instance_source = ctx_obj.config.get_instance_name_and_source()
     _, api_key_source = ctx_obj.config.get_api_key_and_source()
@@ -46,16 +48,24 @@ def status_cmd(ctx: click.Context, **kwargs: Any) -> int:
         json_output["api_key_source"] = api_key_source.name
         if token_scopes is not None:
             json_output["token_scopes"] = token_scopes
+        if account_id is not None:
+            json_output["account_id"] = account_id
         click.echo(json.dumps(json_output))
     else:
         scopes_line = (
             f"{format_text('Token scopes:', STYLE['key'])} {', '.join(token_scopes)}\n"
             if token_scopes is not None
             else ""
         )
+        account_line = (
+            f"{format_text('Account ID:', STYLE['key'])} {account_id}\n"
+            if account_id is not None
+            else ""
+        )
         click.echo(
             f"{format_text('API URL:', STYLE['key'])} {instance}\n"
-            f"{format_text('Status:', STYLE['key'])} {format_healthcheck_status(response)}\n"
+            + account_line
+            + f"{format_text('Status:', STYLE['key'])} {format_healthcheck_status(response)}\n"
             f"{format_text('App version:', STYLE['key'])} {response.app_version or 'Unknown'}\n"
             f"{format_text('Secrets engine version:', STYLE['key'])} "
             f"{response.secrets_engine_version or 'Unknown'}\n\n"

tests/unit/cmd/test_status.py

@@ -48,6 +48,7 @@ def test_api_status(cli_fs_runner, api_status_json_schema):
                     "instance_source": In(x.name for x in ConfigSource),
                     "api_key_source": In(x.name for x in ConfigSource),
                     "token_scopes": ["scan"],
+                    "account_id": 1,
                 }
             )
         )
@@ -198,6 +199,22 @@ def test_api_status_shows_token_scopes(cli_fs_runner):
     assert "scan" in result.output
 
 
+def test_api_status_shows_account_id(cli_fs_runner):
+    """
+    GIVEN a valid API token
+    WHEN running api-status
+    THEN the workspace id is displayed as the account id, right below the API URL
+    """
+    with my_vcr.use_cassette("test_health_check"):
+        result = cli_fs_runner.invoke(cli, ["api-status"], color=False)
+    assert_invoke_ok(result)
+    assert "Account ID: 1" in result.output
+
+    lines = result.output.splitlines()
+    api_url_index = next(i for i, line in enumerate(lines) if line.startswith("API URL:"))
+    assert lines[api_url_index + 1].startswith("Account ID:")
+
+
 @mock.patch(
     "pygitguardian.GGClient.api_tokens",
     return_value=Detail("Unauthorized", 401),
@@ -212,8 +229,10 @@ def test_api_status_scopes_omitted_on_error(
     """
     GIVEN an api_tokens call that returns an error
     WHEN running api-status
-    THEN the command succeeds and token scopes are simply omitted from the output
+    THEN the command succeeds and token scopes and account id are simply
+        omitted from the output
     """
     result = cli_fs_runner.invoke(cli, ["api-status"], color=False)
     assert_invoke_ok(result)
     assert "Token scopes:" not in result.output
+    assert "Account ID:" not in result.output