Orion Auth Backend API

OAuth2/OIDC authentication server with user management, RBAC, MFA, and federation support.

Version: 1.0
Host: auth.nhsoul.fr
Base Path: /

Table of Contents

• Account (15 endpoints)
• Admin - Audit (1 endpoints)
• Admin - Clients (7 endpoints)
• Admin - Federation (5 endpoints)
• Admin - Invitations (3 endpoints)
• Admin - Keys (2 endpoints)
• Admin - Password Policy (2 endpoints)
• Admin - Policies (10 endpoints)
• Admin - RBAC (10 endpoints)
• Admin - Resources (11 endpoints)
• Admin - Settings (2 endpoints)
• Admin - Users (5 endpoints)
• Auth (7 endpoints)
• Federation (9 endpoints)
• Health (1 endpoints)
• Invitations (3 endpoints)
• M2M - Users (8 endpoints)
• MFA (4 endpoints)
• OAuth2 (12 endpoints)
• OIDC (4 endpoints)
• Password Policy (1 endpoints)
• Profile (3 endpoints)
• Sessions (3 endpoints)
• Models (57 schemas)

Account

DELETE /api/v1/me

Schedule own account deletion with grace period (step-up required)

Responses:

Code	Description
200	OK

Auth: BearerAuth

---

POST /api/v1/me/account/cancel-deletion

Cancel a pending account deletion using the emailed token

Parameters:

Name	In	Type	Required	Description
body	body	CancelDeletionInput	Yes	token

Responses:

Code	Description
200	OK

---

POST /api/v1/me/account/email/change-request

Request an email address change (step-up required)

Parameters:

Name	In	Type	Required	Description
body	body	ChangeEmailRequestInput	Yes	new email

Responses:

Code	Description
200	OK

Auth: BearerAuth

---

POST /api/v1/me/account/email/confirm

Confirm a pending email change with the token from the email

Parameters:

Name	In	Type	Required	Description
body	body	ConfirmEmailChangeInput	Yes	token

Responses:

Code	Description
200	OK

---

GET /api/v1/me/passkeys

List own passkeys

Responses:

Code	Description
200	OK

Auth: BearerAuth

---

POST /api/v1/me/passkeys/login/begin

Begin usernameless passkey login (public)

Responses:

Code	Description
200	challenge_id (uuid) + options (PublicKeyCredentialRequestOptions JSON)

---

POST /api/v1/me/passkeys/login/finish

Finish usernameless passkey login (public). Returns the user and passkey; caller is responsible for issuing a session.

Parameters:

Name	In	Type	Required	Description
body	body	FinishLoginInput	Yes	challenge id + raw response

Responses:

Code	Description
200	OK

---

POST /api/v1/me/passkeys/reauth/begin

Start a passkey-based reauth challenge

Responses:

Code	Description
200	challenge_id (uuid) + options (PublicKeyCredentialRequestOptions JSON)

Auth: BearerAuth

---

POST /api/v1/me/passkeys/register/begin

Start passkey registration

Responses:

Code	Description
200	challenge_id (uuid) + options (PublicKeyCredentialCreationOptions JSON)

Auth: BearerAuth

---

POST /api/v1/me/passkeys/register/finish

Finish passkey registration

Parameters:

Name	In	Type	Required	Description
body	body	FinishRegistrationInput	Yes	challenge id + raw response

Responses:

Code	Description
200	OK

Auth: BearerAuth

---

DELETE /api/v1/me/passkeys/{id}

Delete a passkey (step-up required)

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Passkey ID

Responses:

Code	Description
200	OK

Auth: BearerAuth

---

PATCH /api/v1/me/passkeys/{id}

Rename a passkey

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Passkey ID
body	body	RenameInput	Yes	new name

Responses:

Code	Description
200	OK

Auth: BearerAuth

---

PUT /api/v1/me/password

Change own password (step-up required)

Parameters:

Name	In	Type	Required	Description
body	body	ChangePasswordInput	Yes	current + new password

Responses:

Code	Description
200	OK

Auth: BearerAuth

---

POST /api/v1/me/reauth

Issue a short-lived step-up reauthentication token

Parameters:

Name	In	Type	Required	Description
body	body	IssueRequest	Yes	Credential payload

Responses:

Code	Description
200	OK
400	Bad Request
401	Unauthorized

Auth: BearerAuth

---

POST /api/v1/me/set-password

Finalise federation onboarding by setting the initial local password

Parameters:

Name	In	Type	Required	Description
body	body	SetInitialPasswordInput	Yes	new password

Responses:

Code	Description
200	OK
400	Bad Request

Auth: BearerAuth

---

Admin - Audit

GET /api/v1/admin/audit-logs

Query audit logs

Parameters:

Name	In	Type	Required	Description
user_id	query	string	No	Filter by user ID
action	query	string	No	Filter by action
from	query	string	No	Start time (RFC3339)
to	query	string	No	End time (RFC3339)
page	query	integer	No	Page number
per_page	query	integer	No	Items per page

Responses:

Code	Description
200	OK
401	Unauthorized
500	Internal Server Error

Auth: BearerAuth

---

Admin - Clients

GET /api/v1/admin/clients

List all clients

Parameters:

Name	In	Type	Required	Description
page	query	integer	No	Page number
per_page	query	integer	No	Items per page

Responses:

Code	Description
200	OK
500	Internal Server Error

Auth: BearerAuth

---

POST /api/v1/admin/clients

Create a new OAuth client

Parameters:

Name	In	Type	Required	Description
body	body	CreateInput	Yes	Client creation payload

Responses:

Code	Description
201	Created
400	Bad Request
500	Internal Server Error

Auth: BearerAuth

---

GET /api/v1/admin/clients/{id}

Get a client by ID

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Client ID

Responses:

Code	Description
200	OK
400	Bad Request
404	Not Found

Auth: BearerAuth

---

DELETE /api/v1/admin/clients/{id}

Delete a client

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Client ID

Responses:

Code	Description
200	OK
400	Bad Request
404	Not Found

Auth: BearerAuth

---

PATCH /api/v1/admin/clients/{id}

Update a client

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Client ID
body	body	UpdateInput	Yes	Client update payload

Responses:

Code	Description
200	OK
400	Bad Request
404	Not Found

Auth: BearerAuth

---

POST /api/v1/admin/clients/{id}/rotate-hmac-secret

Rotate a client's HMAC secret (client_secret_jwt)

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Client ID

Responses:

Code	Description
200	OK
400	Bad Request
404	Not Found

Auth: BearerAuth

---

POST /api/v1/admin/clients/{id}/rotate-secret

Rotate a client's secret

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Client ID

Responses:

Code	Description
200	OK
400	Bad Request
404	Not Found

Auth: BearerAuth

---

Admin - Federation

GET /api/v1/admin/federation

List all federation providers

Responses:

Code	Description
200	OK
500	Internal Server Error

Auth: BearerAuth

---

POST /api/v1/admin/federation

Create a federation provider

Parameters:

Name	In	Type	Required	Description
body	body	CreateProviderInput	Yes	Provider creation payload

Responses:

Code	Description
201	Created
400	Bad Request
500	Internal Server Error

Auth: BearerAuth

---

GET /api/v1/admin/federation/{id}

Get a single federation provider

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Provider ID

Responses:

Code	Description
200	OK
404	Not Found

Auth: BearerAuth

---

DELETE /api/v1/admin/federation/{id}

Delete a federation provider

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Provider ID

Responses:

Code	Description
200	OK
400	Bad Request
404	Not Found

Auth: BearerAuth

---

PATCH /api/v1/admin/federation/{id}

Update a federation provider

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Provider ID
body	body	UpdateProviderInput	Yes	Provider update payload

Responses:

Code	Description
200	OK
400	Bad Request
404	Not Found

Auth: BearerAuth

---

Admin - Invitations

GET /api/v1/admin/invitations

List invitations

Parameters:

Name	In	Type	Required	Description
page	query	integer	No	Page number
per_page	query	integer	No	Items per page

Responses:

Code	Description
200	OK
500	Internal Server Error

Auth: BearerAuth

---

POST /api/v1/admin/invitations

Create an invitation

Parameters:

Name	In	Type	Required	Description
body	body	CreateInput	Yes	Invitation creation payload

Responses:

Code	Description
201	Created
400	Bad Request
401	Unauthorized
500	Internal Server Error

Auth: BearerAuth

---

DELETE /api/v1/admin/invitations/{id}

Delete an invitation

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Invitation ID

Responses:

Code	Description
200	OK
400	Bad Request
404	Not Found

Auth: BearerAuth

---

Admin - Keys

GET /api/v1/admin/keys

List signing keys

Responses:

Code	Description
200	OK
401	Unauthorized

Auth: BearerAuth

---

POST /api/v1/admin/keys/rotate

Rotate the signing key

Responses:

Code	Description
200	OK
401	Unauthorized
500	Internal Server Error

Auth: BearerAuth

---

Admin - Password Policy

GET /api/v1/admin/password-policy

Get the active password policy (admin)

Responses:

Code	Description
200	OK

Auth: BearerAuth

---

PATCH /api/v1/admin/password-policy

Replace the password policy

Parameters:

Name	In	Type	Required	Description
body	body	Policy	Yes	Full policy

Responses:

Code	Description
200	OK
400	Bad Request

Auth: BearerAuth

---

Admin - Policies

GET /api/v1/admin/policies

List all policies

Parameters:

Name	In	Type	Required	Description
type	query	string	No	Filter by policy type

Responses:

Code	Description
200	OK
500	Internal Server Error

Auth: BearerAuth

---

POST /api/v1/admin/policies

Create a new policy

Parameters:

Name	In	Type	Required	Description
body	body	CreatePolicyInput	Yes	Policy creation payload

Responses:

Code	Description
201	Created
400	Bad Request
409	Conflict

Auth: BearerAuth

---

POST /api/v1/admin/policies/replay

Re-evaluate a past denial against current policies

Parameters:

Name	In	Type	Required	Description
body	body	object	Yes	Replay payload {audit_log_id}

Responses:

Code	Description
200	OK
400	Bad Request
404	Not Found

Auth: BearerAuth

---

GET /api/v1/admin/policies/schemas

Per-type input/modify field catalog for autocomplete

Responses:

Code	Description
200	OK

Auth: BearerAuth

---

GET /api/v1/admin/policies/stats

Aggregated stats on policy denials

Parameters:

Name	In	Type	Required	Description
days	query	integer	No	Window size in days (default 7)
limit	query	integer	No	Top-N + recent items cap (default 10)

Responses:

Code	Description
200	OK

Auth: BearerAuth

---

POST /api/v1/admin/policies/test

Test a Rego policy with sample input

Parameters:

Name	In	Type	Required	Description
body	body	TestPolicyInput	Yes	Test payload

Responses:

Code	Description
200	OK
400	Bad Request

Auth: BearerAuth

---

POST /api/v1/admin/policies/validate

Validate Rego syntax

Parameters:

Name	In	Type	Required	Description
body	body	object	Yes	Rego code

Responses:

Code	Description
200	OK
400	Bad Request

Auth: BearerAuth

---

GET /api/v1/admin/policies/{id}

Get a policy by ID

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Policy ID

Responses:

Code	Description
200	OK
400	Bad Request
404	Not Found

Auth: BearerAuth

---

DELETE /api/v1/admin/policies/{id}

Delete a policy

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Policy ID

Responses:

Code	Description
200	OK
400	Bad Request
404	Not Found

Auth: BearerAuth

---

PATCH /api/v1/admin/policies/{id}

Update a policy

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Policy ID
body	body	UpdatePolicyInput	Yes	Policy update payload

Responses:

Code	Description
200	OK
400	Bad Request
404	Not Found

Auth: BearerAuth

---

Admin - RBAC

GET /api/v1/admin/permissions

List all permissions

Responses:

Code	Description
200	OK
500	Internal Server Error

Auth: BearerAuth

---

GET /api/v1/admin/roles

List all roles

Responses:

Code	Description
200	OK
500	Internal Server Error

Auth: BearerAuth

---

POST /api/v1/admin/roles

Create a new role

Parameters:

Name	In	Type	Required	Description
body	body	CreateRoleInput	Yes	Role creation payload

Responses:

Code	Description
201	Created
400	Bad Request
500	Internal Server Error

Auth: BearerAuth

---

GET /api/v1/admin/roles/{id}

Get a role by ID

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Role ID

Responses:

Code	Description
200	OK
400	Bad Request
404	Not Found

Auth: BearerAuth

---

DELETE /api/v1/admin/roles/{id}

Delete a role

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Role ID

Responses:

Code	Description
200	OK
400	Bad Request
404	Not Found

Auth: BearerAuth

---

PATCH /api/v1/admin/roles/{id}

Update a role

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Role ID
body	body	UpdateRoleInput	Yes	Role update payload

Responses:

Code	Description
200	OK
400	Bad Request
404	Not Found

Auth: BearerAuth

---

POST /api/v1/admin/roles/{id}/permissions

Set permissions for a role

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Role ID
body	body	SetPermissionsInput	Yes	Permissions payload

Responses:

Code	Description
200	OK
400	Bad Request
404	Not Found

Auth: BearerAuth

---

GET /api/v1/admin/users/{id}/roles

Get roles assigned to a user

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	User ID

Responses:

Code	Description
200	OK
400	Bad Request
500	Internal Server Error

Auth: BearerAuth

---

POST /api/v1/admin/users/{id}/roles

Assign a role to a user

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	User ID
body	body	AssignRoleInput	Yes	Role assignment payload

Responses:

Code	Description
200	OK
400	Bad Request
500	Internal Server Error

Auth: BearerAuth

---

DELETE /api/v1/admin/users/{id}/roles/{roleId}

Remove a role from a user

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	User ID
roleId	path	string	Yes	Role ID

Responses:

Code	Description
200	OK
400	Bad Request
404	Not Found

Auth: BearerAuth

---

Admin - Resources

GET /api/v1/admin/clients/{id}/resource-permissions

Get resource permissions for a client

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Client ID

Responses:

Code	Description
200	OK
400	Bad Request
500	Internal Server Error

Auth: BearerAuth

---

POST /api/v1/admin/clients/{id}/resource-permissions

Set resource permissions for a client

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Client ID
body	body	SetClientPermissionsInput	Yes	Permission IDs

Responses:

Code	Description
200	OK
400	Bad Request
500	Internal Server Error

Auth: BearerAuth

---

GET /api/v1/admin/resources

List all API resources

Parameters:

Name	In	Type	Required	Description
page	query	integer	No	Page number
per_page	query	integer	No	Items per page

Responses:

Code	Description
200	OK
500	Internal Server Error

Auth: BearerAuth

---

POST /api/v1/admin/resources

Create a new API resource

Parameters:

Name	In	Type	Required	Description
body	body	CreateInput	Yes	Resource creation payload

Responses:

Code	Description
201	Created
400	Bad Request
409	Conflict
500	Internal Server Error

Auth: BearerAuth

---

GET /api/v1/admin/resources/{id}

Get a resource by ID

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Resource ID

Responses:

Code	Description
200	OK
400	Bad Request
404	Not Found

Auth: BearerAuth

---

DELETE /api/v1/admin/resources/{id}

Delete a resource

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Resource ID

Responses:

Code	Description
200	OK
400	Bad Request
404	Not Found

Auth: BearerAuth

---

PATCH /api/v1/admin/resources/{id}

Update a resource

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Resource ID
body	body	UpdateInput	Yes	Resource update payload

Responses:

Code	Description
200	OK
400	Bad Request
404	Not Found

Auth: BearerAuth

---

POST /api/v1/admin/resources/{id}/permissions

Add a permission to a resource

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Resource ID
body	body	AddPermissionInput	Yes	Permission payload

Responses:

Code	Description
201	Created
400	Bad Request
404	Not Found
500	Internal Server Error

Auth: BearerAuth

---

DELETE /api/v1/admin/resources/{id}/permissions/{permId}

Remove a permission from a resource

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Resource ID
permId	path	string	Yes	Permission ID

Responses:

Code	Description
200	OK
400	Bad Request
404	Not Found

Auth: BearerAuth

---

GET /api/v1/admin/roles/{id}/resource-permissions

Get resource permissions for a role

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Role ID

Responses:

Code	Description
200	OK
400	Bad Request
500	Internal Server Error

Auth: BearerAuth

---

POST /api/v1/admin/roles/{id}/resource-permissions

Set resource permissions for a role

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Role ID
body	body	SetRolePermissionsInput	Yes	Permission IDs

Responses:

Code	Description
200	OK
400	Bad Request
500	Internal Server Error

Auth: BearerAuth

---

Admin - Settings

GET /api/v1/admin/settings

Get all application settings

Responses:

Code	Description
200	OK
500	Internal Server Error

Auth: BearerAuth

---

PATCH /api/v1/admin/settings

Update application settings

Parameters:

Name	In	Type	Required	Description
body	body	UpdateSettingsInput	Yes	Settings update payload

Responses:

Code	Description
200	OK
400	Bad Request
500	Internal Server Error

Auth: BearerAuth

---

Admin - Users

GET /api/v1/admin/users

List all users

Parameters:

Name	In	Type	Required	Description
page	query	integer	No	Page number
per_page	query	integer	No	Items per page

Responses:

Code	Description
200	OK
401	Unauthorized
500	Internal Server Error

Auth: BearerAuth

---

GET /api/v1/admin/users/{id}

Get a user by ID

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	User ID (UUID)

Responses:

Code	Description
200	OK
400	Bad Request
401	Unauthorized
404	Not Found

Auth: BearerAuth

---

DELETE /api/v1/admin/users/{id}

Delete a user by ID

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	User ID (UUID)

Responses:

Code	Description
200	OK
400	Bad Request
401	Unauthorized
404	Not Found

Auth: BearerAuth

---

PATCH /api/v1/admin/users/{id}

Update a user by ID

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	User ID (UUID)
body	body	AdminUpdateInput	Yes	Fields to update

Responses:

Code	Description
200	OK
400	Bad Request
401	Unauthorized
404	Not Found

Auth: BearerAuth

---

POST /api/v1/admin/users/{id}/reset-password

Send a password reset email to the target user

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	User ID (UUID)

Responses:

Code	Description
200	OK
400	Bad Request
401	Unauthorized
404	Not Found

Auth: BearerAuth

---

Auth

POST /api/v1/auth/forgot-password

Request a password reset email

Parameters:

Name	In	Type	Required	Description
body	body	ForgotPasswordInput	Yes	Email address

Responses:

Code	Description
200	OK
400	Bad Request

---

POST /api/v1/auth/login

Authenticate a user

Parameters:

Name	In	Type	Required	Description
body	body	LoginInput	Yes	Login credentials

Responses:

Code	Description
200	OK
400	Bad Request
401	Unauthorized

---

POST /api/v1/auth/register

Register a new user

Parameters:

Name	In	Type	Required	Description
body	body	RegisterInput	Yes	Registration payload

Responses:

Code	Description
201	Created
400	Bad Request
403	Forbidden
409	Conflict

---

POST /api/v1/auth/resend-verification

Resend the email verification link

Parameters:

Name	In	Type	Required	Description
body	body	ResendVerificationInput	Yes	Email + optional oauth_request_id

Responses:

Code	Description
200	OK

---

POST /api/v1/auth/reset-password

Reset password using a token

Parameters:

Name	In	Type	Required	Description
body	body	ResetPasswordInput	Yes	Reset token and new password

Responses:

Code	Description
200	OK
400	Bad Request

---

GET /api/v1/auth/verify-email

Consume a verification action token (one-click)

Parameters:

Name	In	Type	Required	Description
token	query	string	Yes	Action token (JWT)

Responses:

Code	Description
302	Redirect to AuthUI error page

---

POST /api/v1/auth/verify-email

Verify email address using a token

Parameters:

Name	In	Type	Required	Description
body	body	VerifyEmailInput	Yes	Verification token

Responses:

Code	Description
200	OK
400	Bad Request

---

Federation

POST /api/v1/auth/federation/complete-signup

Finalise a federation signup by setting the local password

Parameters:

Name	In	Type	Required	Description
body	body	CompleteSignupHTTPInput	Yes	Pending signup token + chosen password

Responses:

Code	Description
200	OK
400	Bad Request

---

POST /api/v1/auth/federation/confirm-link

Confirm a federation account link by supplying the local password

Parameters:

Name	In	Type	Required	Description
body	body	ConfirmLinkInput	Yes	Pending link token + local password

Responses:

Code	Description
200	OK
400	Bad Request
401	Unauthorized

---

GET /api/v1/auth/federation/pending-signup

Read-only view of a pending federation signup

Parameters:

Name	In	Type	Required	Description
token	query	string	Yes	Pending signup token from /complete-account redirect

Responses:

Code	Description
200	OK
400	Bad Request

---

GET /api/v1/auth/federation/{provider}

Initiate social login via a federation provider

Parameters:

Name	In	Type	Required	Description
provider	path	string	Yes	Provider name
return_to	query	string	No	Absolute URL to redirect to after success
oauth_request_id	query	string	No	Continuation: in-progress OrionAuth authorize request ID
invitation_token	query	string	No	Pre-bind a social signup to an invitation

Responses:

Code	Description
302	Found
400	Bad Request
404	Not Found

---

GET /api/v1/auth/federation/{provider}/callback

Handle federation provider callback

Parameters:

Name	In	Type	Required	Description
provider	path	string	Yes	Provider name
code	query	string	Yes	Authorization code from provider
state	query	string	Yes	State previously generated by InitSocialLogin

Responses:

Code	Description
302	Found
400	Bad Request
500	Internal Server Error

---

GET /api/v1/me/linked-accounts

List linked federation accounts for the current user

Responses:

Code	Description
200	OK
401	Unauthorized
500	Internal Server Error

Auth: BearerAuth

---

GET /api/v1/me/linked-accounts/{id}

Get a single linked federation account

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Linked account ID

Responses:

Code	Description
200	OK
401	Unauthorized
404	Not Found

Auth: BearerAuth

---

DELETE /api/v1/me/linked-accounts/{id}

Unlink a federation account

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Linked account ID

Responses:

Code	Description
200	OK
400	Bad Request
401	Unauthorized

Auth: BearerAuth

---

POST /api/v1/me/linked-accounts/{provider}/begin-link

Start linking a federation account to the current user

Parameters:

Name	In	Type	Required	Description
provider	path	string	Yes	Provider name
body	body	BeginLinkAccountInput	No	Optional return_to

Responses:

Code	Description
200	OK
400	Bad Request
401	Unauthorized
403	Forbidden
404	Not Found

Auth: BearerAuth

---

Health

GET /health

Health check

Responses:

Code	Description
200	OK

---

Invitations

GET /api/v1/auth/invitations/lookup

Resolve an invitation token without consuming it

Parameters:

Name	In	Type	Required	Description
token	query	string	Yes	Raw invitation token

Responses:

Code	Description
200	OK
400	Bad Request
404	Not Found

---

POST /api/v1/auth/register/invite

Register a new user with an invitation code

Parameters:

Name	In	Type	Required	Description
body	body	RegisterInviteInput	Yes	Registration payload

Responses:

Code	Description
201	Created
400	Bad Request
500	Internal Server Error

---

GET /api/v1/auth/settings

Get public registration settings

Responses:

Code	Description
200	OK

---

M2M - Users

GET /api/v1/m2m/users

List users (paginated)

Parameters:

Name	In	Type	Required	Description
page	query	integer	No	Page (default 1)
per_page	query	integer	No	Per page (default 20, max 100)

Responses:

Code	Description
200	OK

---

POST /api/v1/m2m/users

Create a user

Parameters:

Name	In	Type	Required	Description
body	body	CreateUserInput	Yes	User to create

Responses:

Code	Description
201	Created

---

GET /api/v1/m2m/users/{id}

Get a user by id

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	User id

Responses:

Code	Description
200	OK

---

DELETE /api/v1/m2m/users/{id}

Delete a user

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	User id

Responses:

Code	Description
200	OK

---

PATCH /api/v1/m2m/users/{id}

Update a user (any field except id)

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	User id
body	body	UpdateUserInput	Yes	Fields to update

Responses:

Code	Description
200	OK

---

POST /api/v1/m2m/users/{id}/mfa/reset

Force-disable TOTP MFA for a user

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	User id

Responses:

Code	Description
200	OK

---

PUT /api/v1/m2m/users/{id}/password

Set a user's password (no current-password check)

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	User id
body	body	SetPasswordInput	Yes	New password

Responses:

Code	Description
200	OK

---

POST /api/v1/m2m/users/{id}/unlock

Clear lock-out (failed_login_attempts + locked_until)

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	User id

Responses:

Code	Description
200	OK

---

MFA

POST /api/v1/me/mfa/backup-codes

Regenerate MFA backup codes

Parameters:

Name	In	Type	Required	Description
body	body	BackupCodesInput	Yes	TOTP code for confirmation

Responses:

Code	Description
200	OK
400	Bad Request
401	Unauthorized

Auth: BearerAuth

---

DELETE /api/v1/me/mfa/totp

Disable TOTP-based MFA

Parameters:

Name	In	Type	Required	Description
body	body	DisableInput	Yes	TOTP code for confirmation

Responses:

Code	Description
200	OK
400	Bad Request
401	Unauthorized

Auth: BearerAuth

---

POST /api/v1/me/mfa/totp/enroll

Enroll in TOTP-based MFA

Responses:

Code	Description
200	OK
401	Unauthorized
409	Conflict

Auth: BearerAuth

---

POST /api/v1/me/mfa/totp/verify

Verify TOTP code to activate MFA

Parameters:

Name	In	Type	Required	Description
body	body	VerifyInput	Yes	TOTP code

Responses:

Code	Description
200	OK
400	Bad Request
401	Unauthorized

Auth: BearerAuth

---

OAuth2

GET /.well-known/oauth-authorization-server

Get OAuth 2.0 authorization server metadata (RFC 8414)

Responses:

Code	Description
200	OK

---

GET /authorize

Initiate OAuth2 authorization request

Parameters:

Name	In	Type	Required	Description
client_id	query	string	Yes	Client ID
redirect_uri	query	string	Yes	Redirect URI
response_type	query	string	Yes	Response type
scope	query	string	No	Requested scopes
state	query	string	No	State parameter
nonce	query	string	No	Nonce for ID token
code_challenge	query	string	No	PKCE code challenge
code_challenge_method	query	string	No	PKCE code challenge method

Responses:

Code	Description
200	OK
400	Bad Request

---

POST /authorize/consent

Submit user consent for OAuth2 authorization

Parameters:

Name	In	Type	Required	Description
input	body	AuthorizeConsentInput	Yes	Consent input

Responses:

Code	Description
200	OK
400	Bad Request

---

POST /authorize/login

Submit login credentials for OAuth2 authorization

Parameters:

Name	In	Type	Required	Description
input	body	AuthorizeLoginInput	Yes	Login credentials

Responses:

Code	Description
200	OK
400	Bad Request
401	Unauthorized

---

POST /authorize/mfa

Submit MFA code for OAuth2 authorization

Parameters:

Name	In	Type	Required	Description
input	body	AuthorizeMFAInput	Yes	MFA verification input

Responses:

Code	Description
200	OK
400	Bad Request
401	Unauthorized

---

POST /authorize/register

Submit signup details for OAuth2 authorization (prompt=create)

Parameters:

Name	In	Type	Required	Description
input	body	AuthorizeRegisterInput	Yes	Signup details

Responses:

Code	Description
200	OK
400	Bad Request
409	Conflict

---

POST /device/approve

Approve or deny a device authorization request

Parameters:

Name	In	Type	Required	Description
input	body	object	Yes	Device approval input (user_code, approved, email, password)

Responses:

Code	Description
200	OK
400	Bad Request
401	Unauthorized

---

POST /device/verify

Verify a device user code

Parameters:

Name	In	Type	Required	Description
input	body	DeviceVerifyInput	Yes	Device verification input

Responses:

Code	Description
200	OK
400	Bad Request

---

POST /device_authorization

Initiate device authorization flow

Parameters:

Name	In	Type	Required	Description
scope	formData	string	No	Requested scopes

Responses:

Code	Description
200	OK
400	Bad Request
401	Unauthorized

---

POST /introspect

Introspect a token

Parameters:

Name	In	Type	Required	Description
token	formData	string	Yes	Token to introspect
token_type_hint	formData	string	No	Token type hint

Responses:

Code	Description
200	OK
400	Bad Request
401	Unauthorized

---

POST /revoke

Revoke a token

Parameters:

Name	In	Type	Required	Description
token	formData	string	Yes	Token to revoke
token_type_hint	formData	string	No	Token type hint

Responses:

Code	Description
200	OK
400	Bad Request
401	Unauthorized

---

POST /token

Exchange credentials for tokens

Parameters:

Name	In	Type	Required	Description
grant_type	formData	string	Yes	Grant type
code	formData	string	No	Authorization code
redirect_uri	formData	string	No	Redirect URI
code_verifier	formData	string	No	PKCE code verifier
refresh_token	formData	string	No	Refresh token
scope	formData	string	No	Requested scopes

Responses:

Code	Description
200	OK
400	Bad Request
401	Unauthorized

---

OIDC

GET /.well-known/jwks.json

Get JSON Web Key Set

Responses:

Code	Description
200	OK

---

GET /.well-known/openid-configuration

Get OpenID Connect discovery configuration

Responses:

Code	Description
200	OK

---

GET /end_session

End session / logout

Parameters:

Name	In	Type	Required	Description
id_token_hint	query	string	No	Previously issued ID Token
post_logout_redirect_uri	query	string	No	URL to redirect after logout
state	query	string	No	Opaque value for the RP
client_id	query	string	No	Client ID

Responses:

Code	Description
302	Redirect to AuthUI logout page

---

GET /userinfo

Get user info claims

Responses:

Code	Description
200	OK
401	Unauthorized

Auth: BearerAuth

---

Password Policy

GET /api/v1/password-policy

Get the active password policy

Responses:

Code	Description
200	OK

---

Profile

GET /api/v1/me

Get the current user's profile

Responses:

Code	Description
200	OK
401	Unauthorized
404	Not Found

Auth: BearerAuth

---

PATCH /api/v1/me

Update the current user's profile

Parameters:

Name	In	Type	Required	Description
body	body	UpdateProfileInput	Yes	Profile fields to update

Responses:

Code	Description
200	OK
400	Bad Request
401	Unauthorized

Auth: BearerAuth

---

POST /api/v1/me/resend-verification

Resend the verification email for the authenticated user

Responses:

Code	Description
200	OK
400	Bad Request
401	Unauthorized

Auth: BearerAuth

---

Sessions

GET /api/v1/me/sessions

List active sessions for the current user

Responses:

Code	Description
200	OK
401	Unauthorized
500	Internal Server Error

Auth: BearerAuth

---

DELETE /api/v1/me/sessions

Revoke all sessions except the current one

Responses:

Code	Description
200	OK
401	Unauthorized
500	Internal Server Error

Auth: BearerAuth

---

DELETE /api/v1/me/sessions/{id}

Revoke a specific session

Parameters:

Name	In	Type	Required	Description
id	path	string	Yes	Session ID (UUID)

Responses:

Code	Description
200	OK
400	Bad Request
401	Unauthorized
404	Not Found

Auth: BearerAuth

---

Models

CancelDeletionInput

Package: account

Field	Type	Required	Description
token	string	Yes

ChangeEmailRequestInput

Package: account

Field	Type	Required	Description
new_email	string	Yes

ConfirmEmailChangeInput

Package: account

Field	Type	Required	Description
token	string	Yes

SetInitialPasswordInput

Package: account

Field	Type	Required	Description
password	string	Yes

CreateInput

Package: client

Field	Type	Required	Description
access_token_ttl	integer	No
backchannel_logout_session_required	boolean	No
backchannel_logout_uri	string	No
description	string	No
frontchannel_logout_session_required	boolean	No
frontchannel_logout_uri	string	No
grant_types	string[]	Yes
id_token_encrypted_response_alg	string	No	JWE encryption (OIDC Core §10.2 / §5.3.2)
id_token_encrypted_response_enc	string	No
id_token_ttl	integer	No
is_first_party	boolean	No
is_public	boolean	No
jwks_uri	string	No
name	string	Yes
post_logout_redirect_uris	string[]	No	Logout (OIDC RP-Initiated / Front-Channel / Back-Channel Logout 1.0)
redirect_uris	string[]	Yes
refresh_token_ttl	integer	No
request_uris	string[]	No
require_pkce	boolean	No
response_types	string[]	No
scopes	string[]	Yes
sector_identifier_uri	string	No
subject_type	string	No	OIDC subject + signed UserInfo
token_auth_method	string	No
userinfo_encrypted_response_alg	string	No
userinfo_encrypted_response_enc	string	No
userinfo_signed_response_alg	string	No

UpdateInput

Package: client

Field	Type	Required	Description
access_token_ttl	integer	No
active	boolean	No
backchannel_logout_session_required	boolean	No
backchannel_logout_uri	string	No
description	string	No
frontchannel_logout_session_required	boolean	No
frontchannel_logout_uri	string	No
grant_types	string[]	No
id_token_encrypted_response_alg	string	No
id_token_encrypted_response_enc	string	No
id_token_ttl	integer	No
is_first_party	boolean	No
jwks_uri	string	No
name	string	No
post_logout_redirect_uris	string[]	No
redirect_uris	string[]	No
refresh_token_ttl	integer	No
request_uris	string[]	No
require_pkce	boolean	No
response_types	string[]	No
scopes	string[]	No
sector_identifier_uri	string	No
subject_type	string	No
token_auth_method	string	No
userinfo_encrypted_response_alg	string	No
userinfo_encrypted_response_enc	string	No
userinfo_signed_response_alg	string	No

BeginLinkAccountInput

Package: federation

Field	Type	Required	Description
return_to	string	No	ReturnTo is the URL the AuthUI wants the user to land on after the
provider callback completes (must be same-origin with the AuthUI base).
Defaults to AuthUI /linked-accounts when empty.

CompleteSignupHTTPInput

Package: federation

Field	Type	Required	Description
display_name	string	No
extra_fields	object	No
password	string	Yes
token	string	Yes

ConfirmLinkInput

Package: federation

Field	Type	Required	Description
password	string	Yes
token	string	Yes

CreateProviderInput

Package: federation

No properties defined.

UpdateProviderInput

Package: federation

No properties defined.

CreateInput

Package: invitation

Field	Type	Required	Description
email	string	Yes
role_ids	string[]	No

RegisterInviteInput

Package: invitation

Field	Type	Required	Description
display_name	string	No
password	string	Yes
token	string	Yes

UpdateSettingsInput

Package: invitation

Field	Type	Required	Description
default_access_token_ttl	integer	No
default_id_token_ttl	integer	No
default_post_register_redirect_url	string	No
default_refresh_token_ttl	integer	No
default_session_extended_ttl	integer	No
default_session_ttl	integer	No
invitations_default_role	string	No
registration_email_verification_required	boolean	No
registration_enabled	boolean	No

CreateUserInput

Package: m2m

Field	Type	Required	Description
active	boolean	No
avatar_url	string	No
display_name	string	No
email	string	Yes
email_verified	boolean	No
metadata	ProfileMetadata	No
password	string	No
phone	string	No
role_ids	string[]	No

CreateUserResult

Package: m2m

Field	Type	Required	Description
generated_password	string	No
user	object	No

SetPasswordInput

Package: m2m

Field	Type	Required	Description
password	string	Yes

UpdateUserInput

Package: m2m

Field	Type	Required	Description
active	boolean	No
avatar_url	string	No
display_name	string	No
email	string	No
email_verified	boolean	No
metadata	ProfileMetadata	No
phone	string	No

BackupCodesInput

Package: mfa

Field	Type	Required	Description
code	string	Yes

DisableInput

Package: mfa

Field	Type	Required	Description
code	string	Yes

VerifyInput

Package: mfa

Field	Type	Required	Description
code	string	Yes

AddressClaim

Package: model

Field	Type	Required	Description
country	string	No
formatted	string	No
locality	string	No
postal_code	string	No
region	string	No
street_address	string	No

ProfileMetadata

Package: model

Field	Type	Required	Description
address	AddressClaim	No
birthdate	string	No
family_name	string	No
gender	string	No
given_name	string	No
locale	string	No
middle_name	string	No
nickname	string	No
phone_number_verified	boolean	No
preferred_username	string	No
profile	string	No
website	string	No
zoneinfo	string	No

AuthorizeConsentInput

Package: oauth

Field	Type	Required	Description
request_id	string	Yes
scopes_granted	string[]	Yes

AuthorizeLoginInput

Package: oauth

Field	Type	Required	Description
email	string	Yes
password	string	Yes
remember_me	boolean	No
request_id	string	Yes

AuthorizeMFAInput

Package: oauth

Field	Type	Required	Description
code	string	Yes
request_id	string	Yes

AuthorizeRegisterInput

Package: oauth

Field	Type	Required	Description
display_name	string	No
email	string	Yes
extra_fields	object	No
password	string	Yes
request_id	string	Yes

DeviceVerifyInput

Package: oauth

Field	Type	Required	Description
user_code	string	Yes

FinishLoginInput

Package: passkey

Field	Type	Required	Description
challenge_id	string	Yes
response	integer[]	Yes

FinishRegistrationInput

Package: passkey

Field	Type	Required	Description
challenge_id	string	Yes
name	string	No
response	integer[]	Yes	raw PublicKeyCredential JSON

RenameInput

Package: passkey

Field	Type	Required	Description
name	string	Yes

Policy

Package: password

Field	Type	Required	Description
max_length	integer	No
min_length	integer	No
min_score	integer	No
require_digit	boolean	No
require_lowercase	boolean	No
require_symbol	boolean	No
require_uppercase	boolean	No

AppError

Package: pkg

Field	Type	Required	Description
code	string	No
message	string	No

PaginatedResponse

Package: pkg

Field	Type	Required	Description
data		No
page	integer	No
per_page	integer	No
total	integer	No
total_pages	integer	No

CreatePolicyInput

Package: policy

Field	Type	Required	Description
active	boolean	No
description	string	No
name	string	Yes
priority	integer	No
rego	string	Yes
type	string	Yes

TestPolicyInput

Package: policy

Field	Type	Required	Description
input	object	Yes
rego	string	Yes

UpdatePolicyInput

Package: policy

Field	Type	Required	Description
active	boolean	No
description	string	No
name	string	No
priority	integer	No
rego	string	No

AssignRoleInput

Package: rbac

Field	Type	Required	Description
role_id	string	Yes

CreateRoleInput

Package: rbac

Field	Type	Required	Description
description	string	No
name	string	Yes

SetPermissionsInput

Package: rbac

Field	Type	Required	Description
permission_ids	string[]	Yes

UpdateRoleInput

Package: rbac

Field	Type	Required	Description
description	string	No
name	string	No

IssueRequest

Package: reauth

Field	Type	Required	Description
code	string	No	TOTP or backup code
method	string	Yes
passkey_challenge_id	string	No
passkey_response	integer[]	No	raw assertion JSON
password	string	No

IssueResponse

Package: reauth

Field	Type	Required	Description
expires_at	string	No
method	string	No
reauth_token	string	No

AddPermissionInput

Package: resource

Field	Type	Required	Description
description	string	No
name	string	Yes

CreateInput

Package: resource

Field	Type	Required	Description
access_token_ttl	integer	No
description	string	No
identifier	string	Yes
name	string	Yes
signing_alg	string	No
token_format	string	No

SetClientPermissionsInput

Package: resource

Field	Type	Required	Description
permission_ids	string[]	Yes

SetRolePermissionsInput

Package: resource

Field	Type	Required	Description
permission_ids	string[]	Yes

UpdateInput

Package: resource

Field	Type	Required	Description
access_token_ttl	integer	No
active	boolean	No
description	string	No
name	string	No
signing_alg	string	No
token_format	string	No

AdminUpdateInput

Package: user

Field	Type	Required	Description
active	boolean	No
display_name	string	No
email	string	No
email_verified	boolean	No

ChangePasswordInput

Package: user

Field	Type	Required	Description
current_password	string	Yes
new_password	string	Yes

ForgotPasswordInput

Package: user

Field	Type	Required	Description
email	string	Yes

LoginInput

Package: user

Field	Type	Required	Description
email	string	Yes
password	string	Yes

RegisterInput

Package: user

Field	Type	Required	Description
display_name	string	No
email	string	Yes
extra_fields	object	No
password	string	Yes

ResendVerificationInput

Package: user

Field	Type	Required	Description
email	string	Yes
oauth_request_id	string	No

ResetPasswordInput

Package: user

Field	Type	Required	Description
new_password	string	Yes
token	string	Yes

UpdateProfileInput

Package: user

Field	Type	Required	Description
avatar_url	string	No
display_name	string	No
metadata	ProfileMetadata	No
phone	string	No

VerifyEmailInput

Package: user

Field	Type	Required	Description
token	string	Yes