Auth

PUT/admin/auth/org/{id}/sso

Revoke_api_key

Authorization

bearer_token

AuthorizationBearer <token>

In: header

`application/json`

curl -X DELETE "https://example.com/api/v1/auth/api-keys/string"

{  "message": "string"}

POST/api/v1/auth/cli/session/{id}/complete

Cli_complete_session

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Response Body

curl -X POST "https://example.com/api/v1/auth/cli/session/string/complete"

Empty

POST/api/v1/auth/email/verify/send

Create_organization

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request payload for creating a new organization.

logo_url?|

Optional logo URL.

metadata?unknown

Optional metadata (arbitrary JSON).

name*string

Organization display name.

slug*string

URL-friendly slug (unique, case-insensitive).

`application/json`

curl -X POST "https://example.com/api/v1/auth/org" \  -H "Content-Type: application/json" \  -d '{    "name": "string",    "slug": "string"  }'

{  "created_at": "2019-08-24T14:15:22Z",  "created_by": "string",  "logo_url": "string",  "member_count": 0,  "metadata": null,  "name": "string",  "org_id": "string",  "slug": "string",  "sso_enforced": true,  "updated_at": "2019-08-24T14:15:22Z"}

POST/api/v1/auth/org/accept-invite/{id}

Check_slug

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Constrained like the slug it is checking for: the value reaches a TAG filter, where ',' and '|' separate values, so an unconstrained one answers for a batch of slugs at once rather than the one asked about.

Response Body

`application/json`

curl -X GET "https://example.com/api/v1/auth/org/check-slug?slug=string"

{  "available": true}

POST/api/v1/auth/org/clear-active

Clear_active_org

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Response Body

`application/json`

curl -X POST "https://example.com/api/v1/auth/org/clear-active"

{  "access_token": "string",  "expires_in": 0}

POST/api/v1/auth/org/decline-invite/{id}

Decline_invitation

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Path Parameters

id*string

Invitation ID

Response Body

curl -X POST "https://example.com/api/v1/auth/org/decline-invite/string"

Empty

GET/api/v1/auth/org/{id}

Get_organization

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Path Parameters

id*string

Organization ID

Response Body

`application/json`

curl -X GET "https://example.com/api/v1/auth/org/string"

{  "created_at": "2019-08-24T14:15:22Z",  "created_by": "string",  "logo_url": "string",  "member_count": 0,  "metadata": null,  "name": "string",  "org_id": "string",  "slug": "string",  "sso_enforced": true,  "updated_at": "2019-08-24T14:15:22Z"}

PATCH/api/v1/auth/org/{id}

Update_organization

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Path Parameters

id*string

Organization ID

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request payload for updating an organization (PATCH pattern: all fields optional).

logo_url?|

Logo URL.

Defaultnull

metadata?unknown

Metadata (arbitrary JSON).

name?|

Organization display name.

Defaultnull

slug?|

URL-friendly slug (unique, case-insensitive).

Defaultnull

Response Body

`application/json`

curl -X PATCH "https://example.com/api/v1/auth/org/string" \  -H "Content-Type: application/json" \  -d '{}'

{  "created_at": "2019-08-24T14:15:22Z",  "created_by": "string",  "logo_url": "string",  "member_count": 0,  "metadata": null,  "name": "string",  "org_id": "string",  "slug": "string",  "sso_enforced": true,  "updated_at": "2019-08-24T14:15:22Z"}

DELETE/api/v1/auth/org/{id}

Delete_organization

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Path Parameters

id*string

Organization ID

Response Body

curl -X DELETE "https://example.com/api/v1/auth/org/string"

Empty

GET/api/v1/auth/org/{id}/invitations

List_org_invitations

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Path Parameters

id*string

Organization ID

Query Parameters

page?integer

1-indexed page number.

Formatint64

Range0 <= value

page_size?integer

Page size (max 100).

Formatint64

Range0 <= value

Response Body

`application/json`

curl -X GET "https://example.com/api/v1/auth/org/string/invitations"

{  "invitations": [    {      "created_at": "2019-08-24T14:15:22Z",      "email": "string",      "expires_at": "2019-08-24T14:15:22Z",      "invitation_id": "string",      "org_id": "string",      "org_name": "string",      "role": "owner",      "status": "pending"    }  ],  "pagination": {    "has_more": true,    "page": 0,    "page_size": 0,    "total": 0  }}

POST/api/v1/auth/org/{id}/invite

Invite_member

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Path Parameters

id*string

Organization ID

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request payload for inviting a member to an organization.

email*string

Email address of the person to invite.

redirect_url?|

Optional redirect URL for the invitation email link.

role*OrgRole

Role to assign to the invited member.

Value in

"owner"
"admin"
"member"

Response Body

`application/json`

curl -X POST "https://example.com/api/v1/auth/org/string/invite" \  -H "Content-Type: application/json" \  -d '{    "email": "string",    "role": "owner"  }'

{  "created_at": "2019-08-24T14:15:22Z",  "email": "string",  "expires_at": "2019-08-24T14:15:22Z",  "invitation_id": "string",  "org_id": "string",  "org_name": "string",  "role": "owner",  "status": "pending"}

GET/api/v1/auth/org/{id}/members

List_members

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Path Parameters

id*string

Organization ID

Query Parameters

page?integer

1-indexed page number.

Formatint64

Range0 <= value

page_size?integer

Page size (max 100).

Formatint64

Range0 <= value

Response Body

`application/json`

curl -X GET "https://example.com/api/v1/auth/org/string/members"

{  "members": [    {      "created_at": "2019-08-24T14:15:22Z",      "member_id": "string",      "role": "owner",      "user_display_name": "string",      "user_email": "string",      "user_id": "string"    }  ],  "pagination": {    "has_more": true,    "page": 0,    "page_size": 0,    "total": 0  }}

DELETE/api/v1/auth/org/{id}/members/{mid}

Remove_member

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Path Parameters

id*string

Organization ID

mid*string

Member ID

Response Body

curl -X DELETE "https://example.com/api/v1/auth/org/string/members/string"

Empty

PATCH/api/v1/auth/org/{id}/members/{mid}/role

Change_member_role

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Path Parameters

id*string

Organization ID

mid*string

Member ID

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request payload for changing a member's role.

role*OrgRole

The new role to assign.

Value in

"owner"
"admin"
"member"

Response Body

`application/json`

curl -X PATCH "https://example.com/api/v1/auth/org/string/members/string/role" \  -H "Content-Type: application/json" \  -d '{    "role": "owner"  }'

{  "created_at": "2019-08-24T14:15:22Z",  "member_id": "string",  "role": "owner",  "user_display_name": "string",  "user_email": "string",  "user_id": "string"}

GET/api/v1/auth/org/{id}/providers

List_org_providers

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Path Parameters

id*string

Organization ID

Response Body

`application/json`

curl -X GET "https://example.com/api/v1/auth/org/string/providers"

[  {    "authorization_endpoint": "string",    "client_id": "string",    "created_at": "2019-08-24T14:15:22Z",    "enabled": true,    "issuer": "string",    "name": "string",    "org_id": "string",    "provider_id": "string",    "redirect_uri": "string",    "scopes": [      "string"    ],    "teardown_in_progress": true,    "token_endpoint": "string",    "updated_at": "2019-08-24T14:15:22Z",    "userinfo_endpoint": "string"  }]

POST/api/v1/auth/org/{id}/providers

Create_org_provider

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Path Parameters

id*string

Organization ID

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request payload for registering an organization's own identity provider.

authorization_endpoint*string

client_id*string

OIDC client ID issued by the provider.

client_secret*string

OIDC client secret. Encrypted at rest and never returned.

default_app_redirect_url?|

Where to land a login the provider initiates from its own dashboard, which carries no destination of its own. Required for an application-tile login to work.

issuer?string|null

name*string

Human-readable name shown to the organization's members.

scopes?array<string>

token_endpoint*string

userinfo_endpoint*string

Response Body

`application/json`

curl -X POST "https://example.com/api/v1/auth/org/string/providers" \  -H "Content-Type: application/json" \  -d '{    "authorization_endpoint": "string",    "client_id": "string",    "client_secret": "string",    "name": "string",    "token_endpoint": "string",    "userinfo_endpoint": "string"  }'

{  "authorization_endpoint": "string",  "client_id": "string",  "created_at": "2019-08-24T14:15:22Z",  "enabled": true,  "issuer": "string",  "name": "string",  "org_id": "string",  "provider_id": "string",  "redirect_uri": "string",  "scopes": [    "string"  ],  "teardown_in_progress": true,  "token_endpoint": "string",  "updated_at": "2019-08-24T14:15:22Z",  "userinfo_endpoint": "string"}

GET/api/v1/auth/org/{id}/providers/{provider_id}

Get_org_provider

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Path Parameters

id*string

Organization ID

provider_id*string

Provider ID

Response Body

`application/json`

curl -X GET "https://example.com/api/v1/auth/org/string/providers/string"

{  "authorization_endpoint": "string",  "client_id": "string",  "created_at": "2019-08-24T14:15:22Z",  "enabled": true,  "issuer": "string",  "name": "string",  "org_id": "string",  "provider_id": "string",  "redirect_uri": "string",  "scopes": [    "string"  ],  "teardown_in_progress": true,  "token_endpoint": "string",  "updated_at": "2019-08-24T14:15:22Z",  "userinfo_endpoint": "string"}

PATCH/api/v1/auth/org/{id}/providers/{provider_id}

Update_org_provider

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Path Parameters

id*string

Organization ID

provider_id*string

Provider ID

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request payload for changing an organization's identity provider.

Absent means "leave alone" for every field, so a caller who wants to flip enabled does not have to resend the whole configuration and risk clobbering a setting someone else changed in between.

authorization_endpoint?string|null

client_id?string|null

client_secret?|

A replacement client secret. Encrypted at rest and never returned.

default_app_redirect_url?string|null

enabled?|

Whether the provider may be used to log in. Enabling is refused while no domain is proven.

issuer?string|null

name?string|null

scopes?array<string>|null

token_endpoint?string|null

userinfo_endpoint?string|null

Response Body

`application/json`

curl -X PATCH "https://example.com/api/v1/auth/org/string/providers/string" \  -H "Content-Type: application/json" \  -d '{}'

{  "authorization_endpoint": "string",  "client_id": "string",  "created_at": "2019-08-24T14:15:22Z",  "enabled": true,  "issuer": "string",  "name": "string",  "org_id": "string",  "provider_id": "string",  "redirect_uri": "string",  "scopes": [    "string"  ],  "teardown_in_progress": true,  "token_endpoint": "string",  "updated_at": "2019-08-24T14:15:22Z",  "userinfo_endpoint": "string"}

DELETE/api/v1/auth/org/{id}/providers/{provider_id}

Delete_org_provider

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Path Parameters

id*string

Organization ID

provider_id*string

Provider ID

Response Body

curl -X DELETE "https://example.com/api/v1/auth/org/string/providers/string"

Empty

GET/api/v1/auth/org/{id}/providers/{provider_id}/domains

List_org_provider_domains

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Path Parameters

id*string

Organization ID

provider_id*string

Provider ID

Response Body

`application/json`

curl -X GET "https://example.com/api/v1/auth/org/string/providers/string/domains"

[  {    "created_at": "2019-08-24T14:15:22Z",    "domain": "string",    "domain_id": "string",    "last_checked_at": "2019-08-24T14:15:22Z",    "provider_id": "string",    "verification_record_name": "string",    "verification_record_value": "string",    "verified": true,    "verified_at": "2019-08-24T14:15:22Z"  }]

POST/api/v1/auth/org/{id}/providers/{provider_id}/domains

Add_org_provider_domain

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Path Parameters

id*string

Organization ID

provider_id*string

Provider ID

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request payload for claiming an email domain for an organization's provider.

domain*string

A bare hostname such as example.com.

Response Body

`application/json`

curl -X POST "https://example.com/api/v1/auth/org/string/providers/string/domains" \  -H "Content-Type: application/json" \  -d '{    "domain": "string"  }'

{  "created_at": "2019-08-24T14:15:22Z",  "domain": "string",  "domain_id": "string",  "last_checked_at": "2019-08-24T14:15:22Z",  "provider_id": "string",  "verification_record_name": "string",  "verification_record_value": "string",  "verified": true,  "verified_at": "2019-08-24T14:15:22Z"}

DELETE/api/v1/auth/org/{id}/providers/{provider_id}/domains/{domain_id}

Remove_org_provider_domain

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Path Parameters

id*string

Organization ID

provider_id*string

Identity provider ID

domain_id*string

Domain claim ID

Response Body

curl -X DELETE "https://example.com/api/v1/auth/org/string/providers/string/domains/string"

Empty

POST/api/v1/auth/org/{id}/providers/{provider_id}/domains/{domain_id}/verify

Verify_org_provider_domain

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Path Parameters

id*string

Organization ID

provider_id*string

Provider ID

domain_id*string

Domain ID

Response Body

`application/json`

curl -X POST "https://example.com/api/v1/auth/org/string/providers/string/domains/string/verify"

{  "created_at": "2019-08-24T14:15:22Z",  "domain": "string",  "domain_id": "string",  "last_checked_at": "2019-08-24T14:15:22Z",  "provider_id": "string",  "verification_record_name": "string",  "verification_record_value": "string",  "verified": true,  "verified_at": "2019-08-24T14:15:22Z"}

GET/api/v1/auth/org/{id}/providers/{provider_id}/drift

Org_provisioning_drift

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Path Parameters

id*string

Organization ID

provider_id*string

Identity provider ID

Response Body

`application/json`

curl -X GET "https://example.com/api/v1/auth/org/string/providers/string/drift"

{  "links_truncated": true,  "orphaned_links": [    {      "email": "string",      "external_id": "string",      "user_id": "string"    }  ],  "recent_failures": [    {      "at": "string",      "detail": "string",      "status": 0    }  ],  "unlinked_members": [    {      "email": "string",      "external_id": "string",      "user_id": "string"    }  ]}

POST/api/v1/auth/org/{id}/set-active

Set_active_org

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Path Parameters

id*string

Organization ID

Response Body

`application/json`

curl -X POST "https://example.com/api/v1/auth/org/string/set-active"

{  "access_token": "string",  "expires_in": 0,  "name": "string",  "org_id": "string",  "role": "owner",  "slug": "string"}

GET/api/v1/auth/orgs

List_organizations

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Query Parameters

page?integer

1-indexed page number.

Formatint64

Range0 <= value

page_size?integer

Page size (max 100).

Formatint64

Range0 <= value

Response Body

`application/json`

curl -X GET "https://example.com/api/v1/auth/orgs"

{  "organizations": [    {      "created_at": "2019-08-24T14:15:22Z",      "created_by": "string",      "logo_url": "string",      "member_count": 0,      "metadata": null,      "name": "string",      "org_id": "string",      "slug": "string",      "sso_enforced": true,      "updated_at": "2019-08-24T14:15:22Z"    }  ],  "pagination": {    "has_more": true,    "page": 0,    "page_size": 0,    "total": 0  }}

POST/api/v1/auth/passkey/register/options

Passkey_register_options

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request payload for initiating passkey registration (get challenge options).

device_name?|

Optional device name for the passkey.

Defaultnull

Response Body

`application/json`

curl -X POST "https://example.com/api/v1/auth/passkey/register/options" \  -H "Content-Type: application/json" \  -d '{}'

{  "challenge_id": "string",  "options": null}

POST/api/v1/auth/passkey/register/verify

Passkey_register_verify

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request payload for completing passkey registration (verify challenge response).

challenge_id*string

Challenge ID from the registration options response.

device_name*string

Human-readable device name for the passkey.

response*unknown

The WebAuthn credential creation response from the browser.

Response Body

`application/json`

curl -X POST "https://example.com/api/v1/auth/passkey/register/verify" \  -H "Content-Type: application/json" \  -d '{    "challenge_id": "string",    "device_name": "string",    "response": null  }'

{  "backed_up": true,  "created_at": "2019-08-24T14:15:22Z",  "device_name": "string",  "last_used_at": "2019-08-24T14:15:22Z",  "passkey_id": "string"}

GET/api/v1/auth/passkeys

List_passkeys

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Response Body

`application/json`

curl -X GET "https://example.com/api/v1/auth/passkeys"

{  "passkeys": [    {      "backed_up": true,      "created_at": "2019-08-24T14:15:22Z",      "device_name": "string",      "last_used_at": "2019-08-24T14:15:22Z",      "passkey_id": "string"    }  ]}

PATCH/api/v1/auth/passkeys/{id}

Update_passkey

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Path Parameters

id*string

Passkey ID

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request payload for updating a passkey's device name.

device_name*string

New device name for the passkey.

Response Body

`application/json`

curl -X PATCH "https://example.com/api/v1/auth/passkeys/string" \  -H "Content-Type: application/json" \  -d '{    "device_name": "string"  }'

{  "backed_up": true,  "created_at": "2019-08-24T14:15:22Z",  "device_name": "string",  "last_used_at": "2019-08-24T14:15:22Z",  "passkey_id": "string"}

DELETE/api/v1/auth/passkeys/{id}

Delete_passkey

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Path Parameters

id*string

Passkey ID

Response Body

`application/json`

curl -X DELETE "https://example.com/api/v1/auth/passkeys/string"

{  "message": "string"}

POST/api/v1/auth/password/change

Change_password

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request payload for changing the current user's password (requires current password).

current_password*string

The user's current password for verification.

new_password*string

The new password. Must meet minimum length requirements.

Response Body

`application/json`

curl -X POST "https://example.com/api/v1/auth/password/change" \  -H "Content-Type: application/json" \  -d '{    "current_password": "string",    "new_password": "string"  }'

{  "message": "string"}

GET/api/v1/auth/providers

List_external_providers

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Response Body

`application/json`

curl -X GET "https://example.com/api/v1/auth/providers"

{  "providers": [    {      "algorithm": "string",      "audience": "string",      "claim_mapping": {        "email_claim": "string",        "email_verified_claim": "string",        "image_claim": "string",        "name_claim": "string",        "org_id_claim": "string",        "role_claim": "string",        "user_id_claim": "string"      },      "created_at": "2019-08-24T14:15:22Z",      "enabled": true,      "has_webhook_secret": true,      "issuer": "string",      "jwks_url": "string",      "name": "string",      "provider_id": "string",      "updated_at": "2019-08-24T14:15:22Z",      "webhook_signature_header": "string"    }  ]}

POST/api/v1/auth/providers

Create_external_provider

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request payload for registering a new external auth provider.

algorithm*string

JWT signing algorithm (e.g., "RS256", "ES256").

audience?|

Expected aud claim value (optional).

claim_mapping?

How JWT claims from this provider map to user fields.

issuer*string

Expected iss claim value from this provider.

jwks_url?|

JWKS endpoint URL for fetching public keys.

name*string

Human-readable provider name.

provider_id*string

Unique provider identifier (e.g., "clerk", "auth0", "firebase").

static_public_key?|

Static public key (PEM-encoded, alternative to JWKS).

webhook_secret?|

Secret for verifying incoming webhooks from this provider.

An HMAC key, so a short one is not a key: HMAC accepts a zero-length key, and the webhook route is unauthenticated by construction - the signature IS the gate.

webhook_signature_header?|

HTTP header containing the webhook signature.

Response Body

`application/json`

curl -X POST "https://example.com/api/v1/auth/providers" \  -H "Content-Type: application/json" \  -d '{    "algorithm": "string",    "issuer": "string",    "name": "string",    "provider_id": "string"  }'

{  "algorithm": "string",  "audience": "string",  "claim_mapping": {    "email_claim": "string",    "email_verified_claim": "string",    "image_claim": "string",    "name_claim": "string",    "org_id_claim": "string",    "role_claim": "string",    "user_id_claim": "string"  },  "created_at": "2019-08-24T14:15:22Z",  "enabled": true,  "has_webhook_secret": true,  "issuer": "string",  "jwks_url": "string",  "name": "string",  "provider_id": "string",  "updated_at": "2019-08-24T14:15:22Z",  "webhook_signature_header": "string"}

GET/api/v1/auth/providers/{provider_id}

Get_external_provider

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Path Parameters

provider_id*string

External provider ID

Response Body

`application/json`

curl -X GET "https://example.com/api/v1/auth/providers/string"

{  "algorithm": "string",  "audience": "string",  "claim_mapping": {    "email_claim": "string",    "email_verified_claim": "string",    "image_claim": "string",    "name_claim": "string",    "org_id_claim": "string",    "role_claim": "string",    "user_id_claim": "string"  },  "created_at": "2019-08-24T14:15:22Z",  "enabled": true,  "has_webhook_secret": true,  "issuer": "string",  "jwks_url": "string",  "name": "string",  "provider_id": "string",  "updated_at": "2019-08-24T14:15:22Z",  "webhook_signature_header": "string"}

PATCH/api/v1/auth/providers/{provider_id}

Update_external_provider

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Path Parameters

provider_id*string

External provider ID

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request payload for updating an existing external auth provider.

algorithm?|

JWT signing algorithm.

Defaultnull

audience?|

Expected aud claim value.

Defaultnull

claim_mapping?|

Defaultnull

enabled?|

Whether this provider is enabled.

Defaultnull

issuer?|

Expected iss claim value.

Defaultnull

jwks_url?|

JWKS endpoint URL.

Defaultnull

name?|

Human-readable provider name.

Defaultnull

static_public_key?|

Static public key (PEM-encoded).

Defaultnull

webhook_secret?|

Webhook secret. An HMAC key; see the create request for why a short one is refused.

Defaultnull

webhook_signature_header?|

Webhook signature header.

Defaultnull

Response Body

`application/json`

curl -X PATCH "https://example.com/api/v1/auth/providers/string" \  -H "Content-Type: application/json" \  -d '{}'

{  "algorithm": "string",  "audience": "string",  "claim_mapping": {    "email_claim": "string",    "email_verified_claim": "string",    "image_claim": "string",    "name_claim": "string",    "org_id_claim": "string",    "role_claim": "string",    "user_id_claim": "string"  },  "created_at": "2019-08-24T14:15:22Z",  "enabled": true,  "has_webhook_secret": true,  "issuer": "string",  "jwks_url": "string",  "name": "string",  "provider_id": "string",  "updated_at": "2019-08-24T14:15:22Z",  "webhook_signature_header": "string"}

DELETE/api/v1/auth/providers/{provider_id}

Delete_external_provider

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Path Parameters

provider_id*string

External provider ID

Response Body

curl -X DELETE "https://example.com/api/v1/auth/providers/string"

Empty

GET/api/v1/auth/session

Get_session

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Response Body

`application/json`

curl -X GET "https://example.com/api/v1/auth/session"

{  "active": true,  "created_at": "2019-08-24T14:15:22Z",  "expires_at": "2019-08-24T14:15:22Z",  "id": "string",  "ip_address": "string",  "updated_at": "2019-08-24T14:15:22Z",  "user_agent": "string",  "user_id": "string"}

GET/api/v1/auth/sessions

List_sessions

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Query Parameters

page?integer

1-indexed page number

Formatint64

Range0 <= value

page_size?integer

Page size (max 100)

Formatint64

Range0 <= value

Response Body

`application/json`

curl -X GET "https://example.com/api/v1/auth/sessions"

{  "pagination": {    "has_more": true,    "page": 0,    "page_size": 0,    "total": 0  },  "sessions": [    {      "active": true,      "created_at": "2019-08-24T14:15:22Z",      "expires_at": "2019-08-24T14:15:22Z",      "id": "string",      "ip_address": "string",      "updated_at": "2019-08-24T14:15:22Z",      "user_agent": "string",      "user_id": "string"    }  ]}

DELETE/api/v1/auth/sessions/{session_id}

Revoke_session

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Path Parameters

session_id*string

ID of the session to revoke

Response Body

curl -X DELETE "https://example.com/api/v1/auth/sessions/string"

Empty

POST/api/v1/auth/signout

Signout

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Response Body

curl -X POST "https://example.com/api/v1/auth/signout"

Empty

POST/api/v1/auth/users/batch

Admin bulk-onboarding: create many users with no verification emails or sessions

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Admin bulk-onboarding payload: create many users at once. Each user is created without a verification email or session (admin-only); the server enforces a per-batch cap.

users*array<>

Response Body

`application/json`

curl -X POST "https://example.com/api/v1/auth/users/batch" \  -H "Content-Type: application/json" \  -d '{    "users": [      {        "email": "string",        "password": "string"      }    ]  }'

{  "count": 0,  "user_ids": [    "string"  ]}

GET/api/v1/users/{id}

Get_user_profile

Authorization

bearer_token

AuthorizationBearer <token>

In: header

Path Parameters

id*string

User ID

Query Parameters

include?string

Response Body

`application/json`

curl -X GET "https://example.com/api/v1/users/string"

{  "created_at": "2019-08-24T14:15:22Z",  "display_name": "string",  "email": "string",  "email_verified": true,  "id": "string",  "image_url": "string",  "role": "user",  "two_factor_enabled": true,  "updated_at": "2019-08-24T14:15:22Z",  "username": "string",  "_includes": {},  "_relations": {    "property1": {      "has_more": true,      "returned": 0,      "total": 0    },    "property2": {      "has_more": true,      "returned": 0,      "total": 0    }  }}

POST/auth/2fa/backup/verify

Verify_backup_code_login

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request payload for using a backup code during the login flow.

backup_code*string

One of the backup codes generated during 2FA setup (format: xxxx-xxxx-xxxx-xxxx).

two_factor_token*string

Temporary token issued during sign-in when 2FA is required.

Response Body

`application/json`

curl -X POST "https://example.com/auth/2fa/backup/verify" \  -H "Content-Type: application/json" \  -d '{    "backup_code": "string",    "two_factor_token": "string"  }'

{  "access_token": "string",  "expires_in": 0,  "refresh_token": "string",  "requires_2fa": true,  "token_type": "string",  "two_factor_token": "string",  "user": null}

POST/auth/2fa/verify

Verify_2fa_login

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request payload for verifying TOTP during the login flow (uses two_factor_token from Redis).

code*string

The 6-digit TOTP code from the authenticator app.

two_factor_token*string

Temporary token issued during sign-in when 2FA is required.

Response Body

`application/json`

curl -X POST "https://example.com/auth/2fa/verify" \  -H "Content-Type: application/json" \  -d '{    "code": "string",    "two_factor_token": "string"  }'

{  "access_token": "string",  "expires_in": 0,  "refresh_token": "string",  "requires_2fa": true,  "token_type": "string",  "two_factor_token": "string",  "user": null}

GET/auth/accept-invite

Browser landing for an organization invitation.

The link this API emails points here. Accepting needs the invitee's own session, so this page carries the invitation id and asks for one rather than acting on its own.

Response Body

curl -X GET "https://example.com/auth/accept-invite"

Empty

POST/auth/cli/session

Cli_create_session

Response Body

`application/json`

curl -X POST "https://example.com/auth/cli/session"

{  "expires_in": 0,  "login_url": "string",  "poll_secret": "string",  "session_id": "string"}

GET/auth/cli/session/{id}/poll

Cli_poll_session

Path Parameters

id*string

CLI session ID

Query Parameters

secret*string

Poll secret issued when the session was created

Response Body

`application/json`

curl -X GET "https://example.com/auth/cli/session/string/poll?secret=string"

{  "status": "string",  "tokens": null}

POST/auth/email/verify

Verify_email

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request payload for verifying an email or magic-link token.

token*string

The verification token from the email.

Response Body

`application/json`

curl -X POST "https://example.com/auth/email/verify" \  -H "Content-Type: application/json" \  -d '{    "token": "string"  }'

{  "message": "string"}

GET/auth/magic-link

Browser landing for a magic link.

The link this API emails points here, so without it a default deployment mails a dead URL: nothing else redeems the token from a browser, and magic-link sign-in is on by default.

Response Body

curl -X GET "https://example.com/auth/magic-link"

Empty

POST/auth/magic-link/verify

Verify_magic_link

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request payload for verifying an email or magic-link token.

token*string

The verification token from the email.

Response Body

`application/json`

curl -X POST "https://example.com/auth/magic-link/verify" \  -H "Content-Type: application/json" \  -d '{    "token": "string"  }'

{  "access_token": "string",  "expires_in": 0,  "refresh_token": "string",  "requires_2fa": true,  "token_type": "string",  "two_factor_token": "string",  "user": null}

GET/auth/oauth/callback/{provider}

Oauth_callback

Path Parameters

provider*string

OAuth provider ID

Query Parameters

code*string

The authorization code returned by the OAuth provider.

state*string

The state token used to prevent CSRF attacks.

Response Body

curl -X GET "https://example.com/auth/oauth/callback/string?code=string&state=string"

Empty

GET/auth/oauth/providers

Returns the list of enabled platform provider IDs (public, no auth required).

Platform providers only. This route is unauthenticated, so including organization-owned providers would turn it into a customer directory.

Response Body

curl -X GET "https://example.com/auth/oauth/providers"

Empty

POST/auth/passkey/authenticate/options

Passkey_authenticate_options

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request payload for initiating passkey authentication (get challenge options).

username?|

Optional username hint for non-discoverable credential flows.

Defaultnull

Response Body

`application/json`

curl -X POST "https://example.com/auth/passkey/authenticate/options" \  -H "Content-Type: application/json" \  -d '{}'

{  "challenge_id": "string",  "options": null}

POST/auth/passkey/authenticate/verify

Passkey_authenticate_verify

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request payload for completing passkey authentication (verify challenge response).

challenge_id*string

Challenge ID from the authentication options response.

response*unknown

The WebAuthn assertion response from the browser.

Response Body

`application/json`

curl -X POST "https://example.com/auth/passkey/authenticate/verify" \  -H "Content-Type: application/json" \  -d '{    "challenge_id": "string",    "response": null  }'

{  "access_token": "string",  "expires_in": 0,  "refresh_token": "string",  "requires_2fa": true,  "token_type": "string",  "two_factor_token": "string",  "user": null}

POST/auth/password/forgot

Forgot_password

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request payload for the forgot-password flow (sends a reset email).

email*string

The email address associated with the account.

redirect_url?|

Optional redirect URL for the password reset email link.

Response Body

`application/json`

curl -X POST "https://example.com/auth/password/forgot" \  -H "Content-Type: application/json" \  -d '{    "email": "string"  }'

{  "message": "string"}

POST/auth/password/reset

Reset_password

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request payload for resetting a password using a token from the reset email.

new_password*string

The new password. Must meet minimum length requirements.

token*string

The password-reset token from the email.

Response Body

`application/json`

curl -X POST "https://example.com/auth/password/reset" \  -H "Content-Type: application/json" \  -d '{    "new_password": "string",    "token": "string"  }'

{  "message": "string"}

POST/auth/signin/email

Signin_email

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request payload for signing in with email and password.

email*string

User's email address.

password*string

User's password.

Capped like every sibling: nothing longer can be stored, so a longer one is a certain miss that would still buy a full password hash. Refusing it leaks nothing - the answer does not depend on whether the address exists.

Response Body

`application/json`

curl -X POST "https://example.com/auth/signin/email" \  -H "Content-Type: application/json" \  -d '{    "email": "string",    "password": "string"  }'

{  "access_token": "string",  "expires_in": 0,  "refresh_token": "string",  "requires_2fa": true,  "token_type": "string",  "two_factor_token": "string",  "user": null}

POST/auth/signin/magic-link

Request_magic_link

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request payload for requesting a magic-link sign-in email.

email*string

The email address to send the magic link to.

redirect_url?|

Optional redirect URL for the magic link email.

Response Body

`application/json`

curl -X POST "https://example.com/auth/signin/magic-link" \  -H "Content-Type: application/json" \  -d '{    "email": "string"  }'

{  "message": "string"}

POST/auth/signin/oauth

Initiate_oauth

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request payload for initiating an OAuth sign-in flow.

app_redirect_url?|

Where in your application to land once sign-in completes. Must be on the configured allowlist. Defaults to a page served by this API.

provider*string

OAuth provider identifier (e.g., "google", "github", "discord").

redirect_uri*string

The redirect URI the provider should call back to after authorization.

Response Body

`application/json`

curl -X POST "https://example.com/auth/signin/oauth" \  -H "Content-Type: application/json" \  -d '{    "provider": "string",    "redirect_uri": "string"  }'

{  "redirect_url": "string",  "state": "string"}

POST/auth/signup

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request payload for signing up a new user with email and password.

display_name?|

Optional display name.

email*string

User's email address.

password*string

User's password. Must be non-empty; real length check uses config value in the manager.

redirect_url?|

Optional redirect URL for the verification email link.

username?|

Optional username (unique, case-insensitive).

Response Body

`application/json`

curl -X POST "https://example.com/auth/signup" \  -H "Content-Type: application/json" \  -d '{    "email": "string",    "password": "string"  }'

{  "access_token": "string",  "expires_in": 0,  "refresh_token": "string",  "requires_2fa": true,  "token_type": "string",  "two_factor_token": "string",  "user": null}

GET/auth/sso/complete

Response Body

`text/html`

curl -X GET "https://example.com/auth/sso/complete"

Empty

POST/auth/sso/discover

Discover_sso

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request payload for asking which identity provider serves an email address.

email*string

The address the person typed at the sign-in prompt.

Response Body

`application/json`

curl -X POST "https://example.com/auth/sso/discover" \  -H "Content-Type: application/json" \  -d '{    "email": "string"  }'

{  "provider_id": "string",  "provider_name": "string",  "sso_required": true}

POST/auth/sso/exchange

Exchange_sso_code

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request payload for redeeming a single-use SSO handoff code.

code*string

The code delivered to the application's redirect URL.

Response Body

`application/json`

curl -X POST "https://example.com/auth/sso/exchange" \  -H "Content-Type: application/json" \  -d '{    "code": "string"  }'

{  "access_token": "string",  "expires_in": 0,  "refresh_token": "string",  "requires_2fa": true,  "token_type": "string",  "two_factor_token": "string",  "user": null}

GET/auth/sso/idp-initiated/{provider}

curl -X GET "https://example.com/auth/sso/idp-initiated/string"

Empty

POST/auth/token/refresh

Refresh_token

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request payload for refreshing an access token.

refresh_token*string

The refresh token from a previous signin or refresh response.

Response Body

`application/json`

curl -X POST "https://example.com/auth/token/refresh" \  -H "Content-Type: application/json" \  -d '{    "refresh_token": "string"  }'

{  "access_token": "string",  "expires_in": 0,  "refresh_token": "string",  "requires_2fa": true,  "token_type": "string",  "two_factor_token": "string",  "user": null}

GET/auth/verify-email

Browser-friendly email verification — user clicks link in email, server verifies and shows a simple HTML success/failure page.

Query Parameters

token*string

Email verification token from the link

Response Body

curl -X GET "https://example.com/auth/verify-email?token=string"

Empty

POST/auth/webhooks/{provider}

TypeScript Definitions

Use the request body type in TypeScript.

body*string

Response Body

`application/json`

curl -X POST "https://example.com/auth/webhooks/string" \  -H "Content-Type: text/plain" \  -d 'string'

{  "message": "string"}

200application/json

400

403

404

500

200application/json

401

403

200application/json

401

403

404

200application/json

401

403

200application/json

401

403

404

200application/json

400

401

403

404

200application/json

400

401

403

404

200application/json

401

403

404

200application/json

400

401

403

404

200application/json

401

403

404

200application/json

400

401

200application/json

401

200application/json

400

401

200application/json

401

403

409

200application/json

400

401

409

200application/json

401

403

404

409

502

200application/json

400

401

404

200application/json

401

200application/json

401

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`