# Organization API: Customer Authentication: Staff

> The 19 Organization API operations for staff.

Source: https://www.coritan.com/docs/api/reference/organizations/customer-authentication/staff/

Part of [Customer Authentication](/docs/api/reference/organizations/customer-authentication/).

## Operations

| Method | Path | Summary |
| --- | --- | --- |
| POST | [`/api/v1/orgs/{org_slug}/staff/auth/change-password`](#op-post-api-v1-orgs-org-slug-staff-auth-change-password) | Change your own password |
| POST | [`/api/v1/orgs/{org_slug}/staff/auth/customer-session`](#op-post-api-v1-orgs-org-slug-staff-auth-customer-session) | A fresh storefront session for the member's own customer account |
| POST | [`/api/v1/orgs/{org_slug}/staff/auth/forgot-password`](#op-post-api-v1-orgs-org-slug-staff-auth-forgot-password) | Staff forgot password |
| POST | [`/api/v1/orgs/{org_slug}/staff/auth/login`](#op-post-api-v1-orgs-org-slug-staff-auth-login) | Staff login |
| POST | [`/api/v1/orgs/{org_slug}/staff/auth/logout`](#op-post-api-v1-orgs-org-slug-staff-auth-logout) | Staff logout |
| GET | [`/api/v1/orgs/{org_slug}/staff/auth/me`](#op-get-api-v1-orgs-org-slug-staff-auth-me) | Staff me |
| PATCH | [`/api/v1/orgs/{org_slug}/staff/auth/me`](#op-patch-api-v1-orgs-org-slug-staff-auth-me) | Staff patch me |
| GET | [`/api/v1/orgs/{org_slug}/staff/auth/mfa`](#op-get-api-v1-orgs-org-slug-staff-auth-mfa) | Staff MFA status |
| POST | [`/api/v1/orgs/{org_slug}/staff/auth/mfa/disable`](#op-post-api-v1-orgs-org-slug-staff-auth-mfa-disable) | Turn the factor off: password and a current code, both |
| POST | [`/api/v1/orgs/{org_slug}/staff/auth/mfa/enable`](#op-post-api-v1-orgs-org-slug-staff-auth-mfa-enable) | Confirm the code from the freshly scanned secret |
| POST | [`/api/v1/orgs/{org_slug}/staff/auth/mfa/recovery-codes`](#op-post-api-v1-orgs-org-slug-staff-auth-mfa-recovery-codes) | A new set of recovery codes against a current code; the old set is void |
| POST | [`/api/v1/orgs/{org_slug}/staff/auth/mfa/setup`](#op-post-api-v1-orgs-org-slug-staff-auth-mfa-setup) | Start (or restart) enrolment: a fresh secret, the otpauth URI and the QR code for it |
| POST | [`/api/v1/orgs/{org_slug}/staff/auth/mfa/verify`](#op-post-api-v1-orgs-org-slug-staff-auth-mfa-verify) | The second step of signing in |
| POST | [`/api/v1/orgs/{org_slug}/staff/auth/reauth`](#op-post-api-v1-orgs-org-slug-staff-auth-reauth) | Prove it is still you |
| POST | [`/api/v1/orgs/{org_slug}/staff/auth/refresh`](#op-post-api-v1-orgs-org-slug-staff-auth-refresh) | Staff refresh |
| POST | [`/api/v1/orgs/{org_slug}/staff/auth/reset-password`](#op-post-api-v1-orgs-org-slug-staff-auth-reset-password) | Staff reset password |
| GET | [`/api/v1/orgs/{org_slug}/staff/auth/sessions`](#op-get-api-v1-orgs-org-slug-staff-auth-sessions) | Staff my sessions |
| POST | [`/api/v1/orgs/{org_slug}/staff/auth/sessions/revoke-others`](#op-post-api-v1-orgs-org-slug-staff-auth-sessions-revoke-others) | Staff end other sessions |
| DELETE | [`/api/v1/orgs/{org_slug}/staff/auth/sessions/{token_id}`](#op-delete-api-v1-orgs-org-slug-staff-auth-sessions-token-id) | Staff end my session |

### Change your own password {#op-post-api-v1-orgs-org-slug-staff-auth-change-password}

`POST /api/v1/orgs/{org_slug}/staff/auth/change-password`

Change your own password. Every other session you have is ended; the
one making this request stays signed in.

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `org_slug` | path | string | yes |

#### Request body

`application/json` (required)

| Field | Type | Required |
| --- | --- | --- |
| `current_password` | string | yes |
| `new_password` | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### A fresh storefront session for the member's own customer account {#op-post-api-v1-orgs-org-slug-staff-auth-customer-session}

`POST /api/v1/orgs/{org_slug}/staff/auth/customer-session`

A fresh storefront session for the member's own customer account. The
console restores it after a support session ends, or mints one when the
member opens the storefront and has none.

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `org_slug` | path | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Staff forgot password {#op-post-api-v1-orgs-org-slug-staff-auth-forgot-password}

`POST /api/v1/orgs/{org_slug}/staff/auth/forgot-password`

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `org_slug` | path | string | yes |

#### Request body

`application/json` (required)

| Field | Type | Required |
| --- | --- | --- |
| `email` | string | yes |
| `turnstile_token` | string or null | no |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Staff login {#op-post-api-v1-orgs-org-slug-staff-auth-login}

`POST /api/v1/orgs/{org_slug}/staff/auth/login`

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `org_slug` | path | string | yes |

#### Request body

`application/json` (required)

| Field | Type | Required |
| --- | --- | --- |
| `email` | string | yes |
| `password` | string | yes |
| `turnstile_token` | string or null | no |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Staff logout {#op-post-api-v1-orgs-org-slug-staff-auth-logout}

`POST /api/v1/orgs/{org_slug}/staff/auth/logout`

End this console session and every storefront session it minted for
the member, so signing out of the console signs them out of the site.

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `org_slug` | path | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Staff me {#op-get-api-v1-orgs-org-slug-staff-auth-me}

`GET /api/v1/orgs/{org_slug}/staff/auth/me`

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `org_slug` | path | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Staff patch me {#op-patch-api-v1-orgs-org-slug-staff-auth-me}

`PATCH /api/v1/orgs/{org_slug}/staff/auth/me`

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `org_slug` | path | string | yes |

#### Request body

`application/json` (required)

| Field | Type | Required |
| --- | --- | --- |
| `name` | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Staff MFA status {#op-get-api-v1-orgs-org-slug-staff-auth-mfa}

`GET /api/v1/orgs/{org_slug}/staff/auth/mfa`

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `org_slug` | path | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Turn the factor off: password and a current code, both {#op-post-api-v1-orgs-org-slug-staff-auth-mfa-disable}

`POST /api/v1/orgs/{org_slug}/staff/auth/mfa/disable`

Turn the factor off: password and a current code, both. Refused when
the brand requires a second factor of everyone; in that case an admin
resets it from the team page instead, and the member enrols again.

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `org_slug` | path | string | yes |

#### Request body

`application/json` (required)

| Field | Type | Required |
| --- | --- | --- |
| `password` | string | yes |
| `code` | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Confirm the code from the freshly scanned secret {#op-post-api-v1-orgs-org-slug-staff-auth-mfa-enable}

`POST /api/v1/orgs/{org_slug}/staff/auth/mfa/enable`

Confirm the code from the freshly scanned secret. Turns the factor on,
hands out the recovery codes once and, when the caller was a pending
enrolment session, issues the full session too.

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `org_slug` | path | string | yes |

#### Request body

`application/json` (required)

| Field | Type | Required |
| --- | --- | --- |
| `code` | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### A new set of recovery codes against a current code; the old set is void {#op-post-api-v1-orgs-org-slug-staff-auth-mfa-recovery-codes}

`POST /api/v1/orgs/{org_slug}/staff/auth/mfa/recovery-codes`

A new set of recovery codes against a current code; the old set is void.

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `org_slug` | path | string | yes |

#### Request body

`application/json` (required)

| Field | Type | Required |
| --- | --- | --- |
| `code` | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Start (or restart) enrolment: a fresh secret, the otpauth URI and the QR code for it {#op-post-api-v1-orgs-org-slug-staff-auth-mfa-setup}

`POST /api/v1/orgs/{org_slug}/staff/auth/mfa/setup`

Start (or restart) enrolment: a fresh secret, the otpauth URI and the
QR code for it. Nothing is enforced until ``enable`` confirms a code.
Refused while a factor is already on; disable that one first.

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `org_slug` | path | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### The second step of signing in {#op-post-api-v1-orgs-org-slug-staff-auth-mfa-verify}

`POST /api/v1/orgs/{org_slug}/staff/auth/mfa/verify`

The second step of signing in. Bearer is the pending token from
``login``; a right code (or a recovery code) retires it and issues the
full session. A session that is already full gets its step-up stamp
refreshed instead, which is what ``reauth`` with a code does too.

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `org_slug` | path | string | yes |

#### Request body

`application/json` (required)

| Field | Type | Required |
| --- | --- | --- |
| `code` | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Prove it is still you {#op-post-api-v1-orgs-org-slug-staff-auth-reauth}

`POST /api/v1/orgs/{org_slug}/staff/auth/reauth`

Prove it is still you. A password, or a code when two-factor is on
(the code is preferred and required once the factor exists, so a stolen
password alone never reaches the step-up routes).

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `org_slug` | path | string | yes |

#### Request body

`application/json` (required)

| Field | Type | Required |
| --- | --- | --- |
| `password` | string or null | no |
| `code` | string or null | no |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Staff refresh {#op-post-api-v1-orgs-org-slug-staff-auth-refresh}

`POST /api/v1/orgs/{org_slug}/staff/auth/refresh`

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `org_slug` | path | string | yes |

#### Request body

`application/json` (required)

| Field | Type | Required |
| --- | --- | --- |
| `refresh_token` | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Staff reset password {#op-post-api-v1-orgs-org-slug-staff-auth-reset-password}

`POST /api/v1/orgs/{org_slug}/staff/auth/reset-password`

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `org_slug` | path | string | yes |

#### Request body

`application/json` (required)

| Field | Type | Required |
| --- | --- | --- |
| `token` | string | yes |
| `password` | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Staff my sessions {#op-get-api-v1-orgs-org-slug-staff-auth-sessions}

`GET /api/v1/orgs/{org_slug}/staff/auth/sessions`

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `org_slug` | path | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Staff end other sessions {#op-post-api-v1-orgs-org-slug-staff-auth-sessions-revoke-others}

`POST /api/v1/orgs/{org_slug}/staff/auth/sessions/revoke-others`

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `org_slug` | path | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Staff end my session {#op-delete-api-v1-orgs-org-slug-staff-auth-sessions-token-id}

`DELETE /api/v1/orgs/{org_slug}/staff/auth/sessions/{token_id}`

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `token_id` | path | integer | yes |
| `org_slug` | path | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |