All Endpoints

The library exposes 69 endpoints, grouped below by tag. Each page documents the request body, query / path parameters, every response status code, and a copy-pasteable curl example.

Admin-console

• GET /auth/admin/admins — List admins
• GET /auth/admin/api/stats — Dashboard stats
• GET /auth/admin/config — Public admin-console config
• GET /auth/admin/me — Current admin
• POST /auth/admin/admins — Create an admin
• POST /auth/admin/login — Admin login (sets the session cookie)
• POST /auth/admin/logout — Admin logout
• POST /auth/admin/reset-password — Reset an admin's password
• POST /auth/admin/signup — Create an admin (secret-key gated)
• PATCH /auth/admin/admins/{id} — Update an admin
• DELETE /auth/admin/admins/{id} — Delete an admin

Admin-permissions

• GET /auth/admin/api/permissions — List permissions
• GET /auth/admin/api/permissions/{id} — Get a permission
• GET /auth/admin/api/permissions/categories — List permission categories
• GET /auth/admin/api/permissions/guards — List guard namespaces
• GET /auth/admin/api/permissions/search — Search permissions
• POST /auth/admin/api/permissions — Create a permission
• PATCH /auth/admin/api/permissions/{id} — Update a permission
• DELETE /auth/admin/api/permissions/{id} — Delete a permission

Admin-roles

• GET /auth/admin/api/roles — List roles
• POST /auth/admin/api/roles — Create a role
• PATCH /auth/admin/api/roles/{id} — Update a role
• DELETE /auth/admin/api/roles/{id} — Delete a role

Admin-tenants

• GET /auth/admin/api/tenants — List tenants
• POST /auth/admin/api/tenants — Create a tenant
• PATCH /auth/admin/api/tenants/{id} — Update a tenant
• DELETE /auth/admin/api/tenants/{id} — Delete a tenant

Admin-users

• GET /auth/admin/api/users — List users (paginated, cross-tenant; filter by status/tenant/role/search)
• GET /auth/admin/api/users/{id} — Get a user (with roles, sessions, identities)
• GET /auth/admin/api/users/{id}/sessions — List a user's active sessions
• POST /auth/admin/api/users — Create a user
• PATCH /auth/admin/api/users/{id} — Update a user
• DELETE /auth/admin/api/users/{id} — Delete a user
• DELETE /auth/admin/api/users/{id}/sessions — Revoke all of a user's sessions
• DELETE /auth/admin/api/users/{id}/sessions/{sessionId} — Revoke a single user session
• DELETE /auth/admin/api/users/{id}/totp-devices/{deviceId} — Remove a user's TOTP device

Authentication

• GET /auth/accounts — List logged-in accounts (cookie multi-account)
• GET /auth/callback/{provider} — SSO Callback
• GET /auth/client-config — Client config
• GET /auth/me — Get Session User Data and menage extra user data from config
• GET /auth/tenants/lookup — Resolve a tenant by slug (public)
• GET /auth/user — Get Logged In User
• GET /auth/verify-session — Verify Session
• POST /auth/change-password — Change Password
• POST /auth/forgot-password — Forgot password
• POST /auth/invite — Invite a member (admin)
• POST /auth/login — Login
• POST /auth/logout — Logout
• POST /auth/logout-all — Logout All
• POST /auth/mfa/verify — Verify MFA
• POST /auth/passwordless/send — Passwordless — send login code (email or SMS)
• POST /auth/refresh-token — Refresh Token
• POST /auth/reset-password — Reset password
• POST /auth/send-email-verification — Send email verification
• POST /auth/send-phone-verification — Send phone verification (SMS OTP)
• POST /auth/signup — Signup
• POST /auth/switch-tenant — Switch Active Tenant
• POST /auth/verify-email — Verify Email
• POST /auth/verify-forgot-password-otp — Verify Forgot Password OTP and get reset token
• POST /auth/verify-phone — Verify phone number with OTP

Mfa

• GET /auth/mfa/devices — List registered MFA devices
• GET /auth/mfa/status — Get MFA status for the current user
• POST /auth/mfa/challenge — Send MFA code for setup/verification
• POST /auth/mfa/generate-recovery-code — Generate Recovery Codes
• POST /auth/mfa/reset-totp — Reset TOTP Device
• POST /auth/mfa/setup-totp — Setup TOTP Device
• POST /auth/mfa/toggle — Enable or disable MFA for the current user
• POST /auth/mfa/verify-totp-setup — Verify TOTP Setup
• DELETE /auth/mfa/devices/{deviceId} — Remove a registered MFA device