Organization API: Customer Authentication: Auth

Part of Customer Authentication.

POST /api/v1/orgs/{org_slug}/auth/forgot-password

Issue a password-reset token stored on the customer metadata. Always returns success to avoid email enumeration.

application/json (required)

POST /api/v1/orgs/{org_slug}/auth/login

Password sign-in with an email address or a username.

application/json (required)

POST /api/v1/orgs/{org_slug}/auth/logout

Revoke the current access token (and its refresh twin if present).

GET /api/v1/orgs/{org_slug}/auth/me

Fields of a 200 response:

PATCH /api/v1/orgs/{org_slug}/auth/me

application/json (required)

Fields of a 200 response:

GET /api/v1/orgs/{org_slug}/auth/mfa

POST /api/v1/orgs/{org_slug}/auth/mfa/disable

Turn the factor off with a current code, and with the password when the account has one. Refused while the brand requires a factor of everyone.

application/json (required)

POST /api/v1/orgs/{org_slug}/auth/mfa/enable

application/json (required)

POST /api/v1/orgs/{org_slug}/auth/mfa/recovery-codes

application/json (required)

POST /api/v1/orgs/{org_slug}/auth/mfa/setup

POST /api/v1/orgs/{org_slug}/auth/mfa/verify

application/json (required)

GET /api/v1/orgs/{org_slug}/auth/oauth/connections

A 200 response is a list; each item has these fields:

DELETE /api/v1/orgs/{org_slug}/auth/oauth/connections/{provider}

GET /api/v1/orgs/{org_slug}/auth/oauth/providers

Public: which social providers are configured for storefront login.

Fields of a 200 response:

POST /api/v1/orgs/{org_slug}/auth/oauth/set-password

application/json (required)

GET /api/v1/orgs/{org_slug}/auth/oauth/{provider}/authorize

GET /api/v1/orgs/{org_slug}/auth/oauth/{provider}/callback

POST /api/v1/orgs/{org_slug}/auth/refresh

Fields of a 200 response:

POST /api/v1/orgs/{org_slug}/auth/register

Self-service customer signup for the org storefront.

application/json (required)

POST /api/v1/orgs/{org_slug}/auth/resend-verification

Send another confirmation link to the signed-in customer's own address.

Authenticated rather than taking an email in the body: an anonymous version would let anyone post mail to any address on this org's behalf, and there is nothing to gain from it when the customer can already sign in.

POST /api/v1/orgs/{org_slug}/auth/reset-password

application/json (required)

GET /api/v1/orgs/{org_slug}/auth/sessions

Where this account is currently signed in.

The token row already records the address and user agent it was issued to, so a customer can see a session they do not recognise without us keeping a second log of it. Tokens are never returned, only the hash we match the caller's own session on. country_code is where the address places (see _session_countries), or null when nothing can place it, so the page can say "Germany · 203.0.113.9" rather than an address alone.

Support sessions are labelled rather than hidden. An admin looking at an account shows up here as a sign-in from an address the customer will not recognise, and the honest answer to that is to say what it is.

POST /api/v1/orgs/{org_slug}/auth/sessions/revoke-others

Sign out everywhere except here.

The one action worth having after a shared or stolen laptop, and it must not log the customer out of the browser asking for it, so the presented token is the one row left alone.

GET /api/v1/orgs/{org_slug}/auth/username-available

Whether a username can be taken at signup, and why not when it cannot.

Public, because the signup form asks while somebody is still typing and has no session yet. It gives away nothing the community pages do not: a handle is the name everyone already sees above every message its owner posts. Answers rather than raising, so a 422 per keystroke is not the shape of it.

POST /api/v1/orgs/{org_slug}/auth/verify-email

Confirm an address from an emailed link.

Public, because the customer may follow the link in a browser that is not signed in. The token is the credential, and it only ever sets a flag nothing reads for access.

application/json (required)