{ "components": { "headers": { "X-Request-Id": { "description": "Correlates this HTTP attempt with server logs. Generated by the server; any client-supplied value is ignored.", "schema": { "format": "uuid", "type": "string" } } }, "parameters": { "CollectionLimit": { "description": "Maximum number of items per page. Default 50, maximum 100.", "in": "query", "name": "limit", "required": false, "schema": { "default": 50, "maximum": 100, "minimum": 1, "type": "integer" } }, "CursorAfter": { "description": "Opaque, signed cursor previously returned as meta.pageInfo.nextCursor. Clients store and return it; they never interpret its contents.", "in": "query", "name": "after", "required": false, "schema": { "maxLength": 2048, "minLength": 1, "type": "string" } } }, "schemas": { "Envelope": { "description": "The single success envelope every non-exempt route returns. \"data\" carries the operation result; \"meta\" carries optional transversal information such as pagination.", "properties": { "data": { "description": "The operation result. Its shape is declared per route." }, "meta": { "additionalProperties": true, "description": "Transversal information about the response.", "properties": { "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "type": "object" } }, "required": [ "data" ], "type": "object" }, "PageInfo": { "additionalProperties": false, "properties": { "hasNextPage": { "type": "boolean" }, "nextCursor": { "nullable": true, "type": "string" } }, "required": [ "hasNextPage", "nextCursor" ], "type": "object" }, "ProblemDetails": { "additionalProperties": false, "properties": { "code": { "type": "string" }, "detail": { "type": "string" }, "errors": { "items": { "additionalProperties": false, "properties": { "code": { "type": "string" }, "field": { "type": "string" }, "location": { "type": "string" }, "message": { "type": "string" } }, "required": [ "location", "field", "code", "message" ], "type": "object" }, "type": "array" }, "retryable": { "type": "boolean" }, "status": { "maximum": 9007199254740991, "minimum": -9007199254740991, "type": "integer" }, "title": { "type": "string" }, "traceId": { "type": "string" }, "type": { "type": "string" } }, "required": [ "type", "title", "status", "detail", "code", "retryable" ], "type": "object" }, "ProblemFieldError": { "additionalProperties": false, "properties": { "code": { "type": "string" }, "field": { "type": "string" }, "location": { "type": "string" }, "message": { "type": "string" } }, "required": [ "location", "field", "code", "message" ], "type": "object" } }, "securitySchemes": { "session": { "bearerFormat": "JWT", "description": "The access token a sign-in or a renewal handed out, sent as `Authorization: Bearer `.", "scheme": "bearer", "type": "http" } } }, "info": { "contact": {}, "description": "Contract for the routes Ninaku actually implements today. Generated from the running Nest application and its Zod validation schemas; it is never hand-written. A route or property absent here does not exist in the real API.", "title": "Ninaku API", "version": "2.0.0" }, "openapi": "3.0.0", "paths": { "/api/v1/password-changes": { "post": { "description": "Proves the current password and replaces it with a new one, then ends every other session this identity holds while the calling session survives. Everything that can go wrong answers the same way, so a caller learns nothing about which check failed.", "operationId": "PasswordChangesController_change_v1", "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "additionalProperties": false, "properties": { "currentPassword": { "maxLength": 200, "minLength": 1, "type": "string" }, "newPassword": { "maxLength": 200, "minLength": 12, "type": "string" } }, "required": [ "currentPassword", "newPassword" ], "type": "object" } } }, "required": true }, "responses": { "204": { "description": "The password changed and every other session is over. The calling session keeps working." } }, "security": [ { "session": [] } ], "summary": "Replace the password on the calling identity", "tags": [ "Identity" ] } }, "/api/v1/password-recoveries": { "post": { "description": "Sends a recovery code to an identifier that can no longer sign in with its password. The answer says the same thing whether or not that identifier has an account, so this route cannot be used to find out which identifiers are registered.", "operationId": "PasswordRecoveriesController_request_v1", "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "oneOf": [ { "additionalProperties": false, "properties": { "identifier": { "maxLength": 320, "minLength": 1, "type": "string" }, "identifierType": { "enum": [ "email" ], "type": "string" } }, "required": [ "identifierType", "identifier" ], "type": "object" }, { "additionalProperties": false, "properties": { "country": { "maxLength": 2, "minLength": 2, "pattern": "^[A-Z]{2}$", "type": "string" }, "identifier": { "maxLength": 320, "minLength": 1, "type": "string" }, "identifierType": { "enum": [ "phone" ], "type": "string" } }, "required": [ "identifierType", "identifier", "country" ], "type": "object" } ] } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/Envelope" }, { "properties": { "data": { "additionalProperties": false, "properties": { "challengeExpiresAt": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" } }, "required": [ "challengeExpiresAt" ], "type": "object" } }, "type": "object" } ] } } }, "description": "" } }, "summary": "Request a password recovery code", "tags": [ "Identity" ] } }, "/api/v1/password-recoveries/confirmations": { "post": { "description": "Proves the recovery code sent to an identifier and replaces its password, then ends every session that identity holds, with no exception, since whoever is recovering the account has to assume every live session could be an attacker. Everything that can go wrong answers the same way.", "operationId": "PasswordRecoveryConfirmationsController_confirm_v1", "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "oneOf": [ { "additionalProperties": false, "properties": { "code": { "maxLength": 12, "minLength": 6, "pattern": "^[0-9A-Za-z]+$", "type": "string" }, "identifier": { "maxLength": 320, "minLength": 1, "type": "string" }, "identifierType": { "enum": [ "email" ], "type": "string" }, "newPassword": { "maxLength": 200, "minLength": 12, "type": "string" } }, "required": [ "identifierType", "identifier", "code", "newPassword" ], "type": "object" }, { "additionalProperties": false, "properties": { "code": { "maxLength": 12, "minLength": 6, "pattern": "^[0-9A-Za-z]+$", "type": "string" }, "country": { "maxLength": 2, "minLength": 2, "pattern": "^[A-Z]{2}$", "type": "string" }, "identifier": { "maxLength": 320, "minLength": 1, "type": "string" }, "identifierType": { "enum": [ "phone" ], "type": "string" }, "newPassword": { "maxLength": 200, "minLength": 12, "type": "string" } }, "required": [ "identifierType", "identifier", "country", "code", "newPassword" ], "type": "object" } ] } } }, "required": true }, "responses": { "204": { "description": "The password changed and every session of that identity is over." } }, "summary": "Recover an account with the code it received", "tags": [ "Identity" ] } }, "/api/v1/provider-nonces": { "post": { "description": "Issues a single-use nonce for the OIDC dance with Google or Apple, shown once. The client hex-encodes SHA-256(nonce) and sends it as the `nonce` authorization parameter to the provider, for Google exactly as for Apple, even though only Apple's own guidance requires hashing it before sending. POST /sign-ins (provider path) and POST /step-ups/providers accept the returned ID token only when its `nonce` claim byte-for-byte matches this exact hash while it is still unexpired and unspent, and they spend it in the same transaction as the act it authenticates. The nonce expires ten minutes after issuance.", "operationId": "ProviderNoncesController_issue_v1", "parameters": [], "responses": { "201": { "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/Envelope" }, { "properties": { "data": { "additionalProperties": false, "properties": { "expiresAt": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" }, "nonce": { "type": "string" } }, "required": [ "nonce", "expiresAt" ], "type": "object" } }, "type": "object" } ] } } }, "description": "" } }, "summary": "Issue a provider sign-in nonce", "tags": [ "Identity" ] } }, "/api/v1/recovery-codes": { "get": { "description": "Answers with the live batch's remaining count and when it was issued. Never a code, never a hash. Answers remaining: 0 with no issuedAt when this identity has never issued a batch or the live batch was fully replaced.", "operationId": "RecoveryCodesController_status_v1", "parameters": [], "responses": { "200": { "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/Envelope" }, { "properties": { "data": { "additionalProperties": false, "properties": { "issuedAt": { "type": "string" }, "remaining": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" } }, "required": [ "remaining" ], "type": "object" } }, "type": "object" } ] } } }, "description": "" } }, "security": [ { "session": [] } ], "summary": "See how many recovery codes are left", "tags": [ "Identity" ] }, "post": { "description": "Requires a live elevation minted for this exact session and identity. Revokes every recovery code this identity already holds live, then issues ten fresh ones sharing a new batch and returns them this one time only. No later route ever returns a code again.", "operationId": "RecoveryCodesController_issue_v1", "parameters": [ { "description": "The elevation token minted by the step-up confirmation route, bound to this exact session.", "in": "header", "name": "x-elevation-token", "required": true, "schema": { "type": "string" } } ], "responses": { "201": { "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/Envelope" }, { "properties": { "data": { "additionalProperties": false, "properties": { "issuedAt": { "type": "string" }, "recoveryCodes": { "items": { "type": "string" }, "type": "array" } }, "required": [ "recoveryCodes", "issuedAt" ], "type": "object" } }, "type": "object" } ] } } }, "description": "" } }, "security": [ { "session": [] } ], "summary": "Issue a fresh batch of recovery codes", "tags": [ "Identity" ] } }, "/api/v1/second-factors": { "get": { "description": "Lists this identity's verified, non-revoked second factors: id, label, when it was verified and when it last proved a code. Never the secret, never the sealed reference. A pending enrolment that has not yet been confirmed is not a second factor and never appears here.", "operationId": "SecondFactorsController_list_v1", "parameters": [ { "in": "query", "name": "limit", "required": false, "schema": { "default": 50, "maximum": 100, "minimum": 1, "type": "integer" } }, { "in": "query", "name": "after", "required": false, "schema": { "maxLength": 2048, "minLength": 1, "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/Envelope" }, { "properties": { "data": { "items": { "additionalProperties": false, "properties": { "id": { "type": "string" }, "label": { "nullable": true, "type": "string" }, "lastUsedAt": { "format": "date-time", "nullable": true, "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" }, "verifiedAt": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" } }, "required": [ "id", "label", "verifiedAt", "lastUsedAt" ], "type": "object" }, "type": "array" }, "meta": { "properties": { "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "pageInfo" ], "type": "object" } }, "required": [ "meta" ], "type": "object" } ] } } }, "description": "" } }, "security": [ { "session": [] } ], "summary": "See the authenticator apps enrolled on this account", "tags": [ "Identity" ] }, "post": { "description": "Requires a live elevation minted for this exact session and identity, presented in the elevation header. Revokes any pending enrolment this identity already started, then opens a new one and returns the seed this one time only: a base32 secret and an otpauth:// URI ready to hand to an authenticator app. No later route ever returns the secret again. Confirming with a current code from that secret through the confirmations route is what makes the method usable.", "operationId": "SecondFactorsController_enrol_v1", "parameters": [ { "description": "The elevation token minted by the step-up confirmation route, bound to this exact session.", "in": "header", "name": "x-elevation-token", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "additionalProperties": false, "properties": { "label": { "maxLength": 120, "minLength": 1, "type": "string" } }, "type": "object" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/Envelope" }, { "properties": { "data": { "additionalProperties": false, "properties": { "id": { "type": "string" }, "otpauthUri": { "type": "string" }, "secret": { "type": "string" } }, "required": [ "id", "secret", "otpauthUri" ], "type": "object" } }, "type": "object" } ] } } }, "description": "" } }, "security": [ { "session": [] } ], "summary": "Start enrolling an authenticator app as a second factor", "tags": [ "Identity" ] } }, "/api/v1/second-factors/confirmations": { "post": { "description": "Answers with a six digit code computed from the secret returned by the enrolment route. Possession of a current code for a secret that only this identity has ever seen is the proof; no elevation is required a second time. A wrong code, an expired window, or no pending enrolment all refuse the same way. On a match the pending method becomes verified and usable.", "operationId": "SecondFactorConfirmationsController_confirm_v1", "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "additionalProperties": false, "properties": { "code": { "maxLength": 8, "minLength": 6, "pattern": "^\\d+$", "type": "string" } }, "required": [ "code" ], "type": "object" } } }, "required": true }, "responses": { "204": { "description": "The pending second factor is now verified and usable." } }, "security": [ { "session": [] } ], "summary": "Prove a current code and verify the pending second factor", "tags": [ "Identity" ] } }, "/api/v1/second-factors/{id}/removals": { "post": { "description": "Requires a live elevation minted for this exact session and identity, presented in the elevation header. Revokes the method by writing its revocation, scoped by both the method id and the caller identity in the same statement. An id that does not exist, belongs to another identity, is still a pending enrolment, or is already revoked all answer the same way: this route is not an existence oracle.", "operationId": "SecondFactorRemovalsController_remove_v1", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" } }, { "description": "The elevation token minted by the step-up confirmation route, bound to this exact session.", "in": "header", "name": "x-elevation-token", "required": true, "schema": { "type": "string" } } ], "responses": { "204": { "description": "That authenticator app no longer works as a second factor." } }, "security": [ { "session": [] } ], "summary": "Remove one authenticator app, once a live elevation proves it is safe", "tags": [ "Identity" ] } }, "/api/v1/session/context": { "get": { "description": "The single call a frontend makes on load: the caller identity, the login identifiers it has verified (masked), which authentication methods are active, and the organization selection state. No organization selection exists yet, so this always answers with none selected and none available; a later phase fills that state instead of replacing this shape.", "operationId": "SessionContextController_get_v1", "parameters": [], "responses": { "200": { "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/Envelope" }, { "properties": { "data": { "additionalProperties": false, "properties": { "activeAuthenticationMethods": { "items": { "additionalProperties": false, "properties": { "methodType": { "enum": [ "password", "external_provider", "passkey" ], "type": "string" } }, "required": [ "methodType" ], "type": "object" }, "type": "array" }, "identityId": { "type": "string" }, "organizationContext": { "additionalProperties": false, "properties": { "hasAvailableOrganizations": { "type": "boolean" }, "selectedOrganizationId": { "nullable": true, "type": "string" } }, "required": [ "selectedOrganizationId", "hasAvailableOrganizations" ], "type": "object" }, "verifiedIdentifiers": { "items": { "additionalProperties": false, "properties": { "identifierType": { "enum": [ "email", "phone" ], "type": "string" }, "maskedValue": { "type": "string" } }, "required": [ "identifierType", "maskedValue" ], "type": "object" }, "type": "array" } }, "required": [ "identityId", "verifiedIdentifiers", "activeAuthenticationMethods", "organizationContext" ], "type": "object" } }, "type": "object" } ] } } }, "description": "" } }, "security": [ { "session": [] } ], "summary": "Learn who is calling and what to do next", "tags": [ "Identity" ] } }, "/api/v1/sign-in-methods": { "get": { "description": "A verified email, a verified phone and the account password are each one way in, in a single shape. Identifier values are masked; nothing is ever a hash or a raw secret. Each entry carries the stable id the removal route accepts.", "operationId": "SignInMethodsController_list_v1", "parameters": [], "responses": { "200": { "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/Envelope" }, { "properties": { "data": { "items": { "additionalProperties": false, "properties": { "id": { "type": "string" }, "kind": { "enum": [ "email", "phone", "password" ], "type": "string" }, "maskedValue": { "nullable": true, "type": "string" } }, "required": [ "id", "kind", "maskedValue" ], "type": "object" }, "type": "array" } }, "type": "object" } ] } } }, "description": "" } }, "security": [ { "session": [] } ], "summary": "List every way this identity currently has to sign in", "tags": [ "Identity" ] }, "post": { "description": "Requires a live elevation minted for this exact session and identity, presented in the elevation header. Starts adding an identifier to the calling identity through the same verify_identifier challenge machinery used at sign-up. An identifier already verified by any account, including this one, refuses. Otherwise a code is sent and the identifier becomes usable only once the confirmation route proves it.", "operationId": "SignInMethodsController_add_v1", "parameters": [ { "description": "The elevation token minted by the step-up confirmation route, bound to this exact session.", "in": "header", "name": "x-elevation-token", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "oneOf": [ { "additionalProperties": false, "properties": { "identifier": { "maxLength": 320, "minLength": 1, "type": "string" }, "identifierType": { "enum": [ "email" ], "type": "string" } }, "required": [ "identifierType", "identifier" ], "type": "object" }, { "additionalProperties": false, "properties": { "country": { "maxLength": 2, "minLength": 2, "pattern": "^[A-Z]{2}$", "type": "string" }, "identifier": { "maxLength": 320, "minLength": 1, "type": "string" }, "identifierType": { "enum": [ "phone" ], "type": "string" } }, "required": [ "identifierType", "identifier", "country" ], "type": "object" } ] } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/Envelope" }, { "properties": { "data": { "additionalProperties": false, "properties": { "challengeExpiresAt": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" } }, "required": [ "challengeExpiresAt" ], "type": "object" } }, "type": "object" } ] } } }, "description": "" } }, "security": [ { "session": [] } ], "summary": "Add a new email or phone as a way in, and send it a code", "tags": [ "Identity" ] } }, "/api/v1/sign-in-methods/confirmations": { "post": { "description": "Requires a live elevation minted for this exact session and identity, presented in the elevation header, because this is the step that actually turns a pending identifier into a permanent way in. Proves the code sent by the addition route. A wrong code charges an attempt against every live challenge it is tried against without ending any of them early; a spent or expired challenge answers the same way as a wrong code.", "operationId": "SignInMethodConfirmationsController_confirm_v1", "parameters": [ { "description": "The elevation token minted by the step-up confirmation route, bound to this exact session. This is the route that turns a pending identifier into a usable way in, so it requires the same live elevation the addition route required; a code that arrives after the elevation expired needs a fresh step-up before it can be answered.", "in": "header", "name": "x-elevation-token", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "additionalProperties": false, "properties": { "code": { "maxLength": 12, "minLength": 6, "pattern": "^[0-9A-Za-z]+$", "type": "string" } }, "required": [ "code" ], "type": "object" } } }, "required": true }, "responses": { "204": { "description": "The identifier is now verified and usable to sign in." } }, "security": [ { "session": [] } ], "summary": "Answer the code and make the added identifier usable", "tags": [ "Identity" ] } }, "/api/v1/sign-in-methods/{id}/removals": { "post": { "description": "Requires a live elevation minted for this exact session and identity, presented in the elevation header. Refuses to remove the last way in: for a password-based identity that means it never leaves the identity with an active password and no verified identifier, or a verified identifier with no active password, unless another self-sufficient method still proves the owner. An id belonging to another identity answers exactly like one that does not exist.", "operationId": "SignInMethodRemovalsController_remove_v1", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" } }, { "description": "The elevation token minted by the step-up confirmation route, bound to this exact session.", "in": "header", "name": "x-elevation-token", "required": true, "schema": { "type": "string" } } ], "responses": { "204": { "description": "That way in no longer works to sign in." } }, "security": [ { "session": [] } ], "summary": "Remove one way in, once a live elevation proves it is safe", "tags": [ "Identity" ] } }, "/api/v1/sign-ins": { "post": { "description": "Proves an identifier and its password and opens a session for one client. Everything that can go wrong answers the same way, so a caller learns nothing about who has an account. When the identity holds an active second factor, this answers a ticket instead of a session: complete the sign-in at POST /sign-ins/second-factors.", "operationId": "SignInsController_open_v1", "parameters": [ { "in": "header", "name": "user-agent", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "oneOf": [ { "additionalProperties": false, "properties": { "client": { "additionalProperties": false, "properties": { "instanceId": { "maxLength": 120, "minLength": 1, "type": "string" }, "label": { "maxLength": 120, "minLength": 1, "type": "string" }, "type": { "enum": [ "web", "android", "ios", "desktop", "other" ], "type": "string" } }, "required": [ "type" ], "type": "object" }, "identifier": { "maxLength": 320, "minLength": 1, "type": "string" }, "identifierType": { "enum": [ "email" ], "type": "string" }, "password": { "maxLength": 200, "minLength": 1, "type": "string" } }, "required": [ "identifierType", "identifier", "password", "client" ], "type": "object" }, { "additionalProperties": false, "properties": { "client": { "additionalProperties": false, "properties": { "instanceId": { "maxLength": 120, "minLength": 1, "type": "string" }, "label": { "maxLength": 120, "minLength": 1, "type": "string" }, "type": { "enum": [ "web", "android", "ios", "desktop", "other" ], "type": "string" } }, "required": [ "type" ], "type": "object" }, "country": { "maxLength": 2, "minLength": 2, "pattern": "^[A-Z]{2}$", "type": "string" }, "identifier": { "maxLength": 320, "minLength": 1, "type": "string" }, "identifierType": { "enum": [ "phone" ], "type": "string" }, "password": { "maxLength": 200, "minLength": 1, "type": "string" } }, "required": [ "identifierType", "identifier", "country", "password", "client" ], "type": "object" }, { "additionalProperties": false, "properties": { "client": { "additionalProperties": false, "properties": { "instanceId": { "maxLength": 120, "minLength": 1, "type": "string" }, "label": { "maxLength": 120, "minLength": 1, "type": "string" }, "type": { "enum": [ "web", "android", "ios", "desktop", "other" ], "type": "string" } }, "required": [ "type" ], "type": "object" }, "idToken": { "maxLength": 4096, "minLength": 1, "type": "string" }, "identifierType": { "enum": [ "google" ], "type": "string" } }, "required": [ "identifierType", "idToken", "client" ], "type": "object" }, { "additionalProperties": false, "properties": { "client": { "additionalProperties": false, "properties": { "instanceId": { "maxLength": 120, "minLength": 1, "type": "string" }, "label": { "maxLength": 120, "minLength": 1, "type": "string" }, "type": { "enum": [ "web", "android", "ios", "desktop", "other" ], "type": "string" } }, "required": [ "type" ], "type": "object" }, "idToken": { "maxLength": 4096, "minLength": 1, "type": "string" }, "identifierType": { "enum": [ "apple" ], "type": "string" } }, "required": [ "identifierType", "idToken", "client" ], "type": "object" } ] } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/Envelope" }, { "properties": { "data": { "oneOf": [ { "additionalProperties": false, "properties": { "accessToken": { "type": "string" }, "accessTokenExpiresAt": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" }, "kind": { "enum": [ "session" ], "type": "string" }, "refreshToken": { "type": "string" }, "sessionExpiresAt": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" } }, "required": [ "kind", "accessToken", "accessTokenExpiresAt", "refreshToken", "sessionExpiresAt" ], "type": "object" }, { "additionalProperties": false, "properties": { "kind": { "enum": [ "second_factor_required" ], "type": "string" }, "secondFactorTicket": { "type": "string" }, "ticketExpiresAt": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" } }, "required": [ "kind", "secondFactorTicket", "ticketExpiresAt" ], "type": "object" } ] } }, "type": "object" } ] } } }, "description": "" } }, "summary": "Open a session", "tags": [ "Identity" ] } }, "/api/v1/sign-ins/history": { "get": { "description": "Lists every session this identity currently holds: not revoked and not expired. Each entry says whether it is the session the presented access token belongs to, so a caller can tell their own client apart from one they do not recognize.", "operationId": "SessionHistoryController_list_v1", "parameters": [ { "in": "query", "name": "limit", "required": false, "schema": { "default": 50, "maximum": 100, "minimum": 1, "type": "integer" } }, { "in": "query", "name": "after", "required": false, "schema": { "maxLength": 2048, "minLength": 1, "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/Envelope" }, { "properties": { "data": { "items": { "additionalProperties": false, "properties": { "clientType": { "enum": [ "web", "android", "ios", "desktop", "other" ], "type": "string" }, "createdAt": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" }, "deviceLabel": { "nullable": true, "type": "string" }, "expiresAt": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" }, "isCurrentSession": { "type": "boolean" }, "lastSeenAt": { "format": "date-time", "nullable": true, "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" }, "sessionId": { "type": "string" } }, "required": [ "sessionId", "clientType", "deviceLabel", "createdAt", "lastSeenAt", "expiresAt", "isCurrentSession" ], "type": "object" }, "type": "array" }, "meta": { "properties": { "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "pageInfo" ], "type": "object" } }, "required": [ "meta" ], "type": "object" } ] } } }, "description": "" } }, "security": [ { "session": [] } ], "summary": "See where this account is open", "tags": [ "Identity" ] } }, "/api/v1/sign-ins/renewals": { "post": { "description": "Exchanges the refresh token a session is holding for a new pair. The old token stops working immediately, and presenting it again ends the session, because a token that comes back after being spent is a token somebody else has.", "operationId": "SessionRenewalsController_renew_v1", "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "additionalProperties": false, "properties": { "refreshToken": { "maxLength": 200, "minLength": 1, "type": "string" } }, "required": [ "refreshToken" ], "type": "object" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/Envelope" }, { "properties": { "data": { "additionalProperties": false, "properties": { "accessToken": { "type": "string" }, "accessTokenExpiresAt": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" }, "refreshToken": { "type": "string" }, "sessionExpiresAt": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" } }, "required": [ "accessToken", "accessTokenExpiresAt", "refreshToken", "sessionExpiresAt" ], "type": "object" } }, "type": "object" } ] } } }, "description": "" } }, "summary": "Stay in without entering again", "tags": [ "Identity" ] } }, "/api/v1/sign-ins/second-factors": { "post": { "description": "Answers the ticket a sign-in handed back when the identity holds an active second factor, and proves either a TOTP code or a recovery code against it, exactly one of the two. An unknown, expired, consumed or exhausted ticket and a wrong, spent, revoked or foreign code all answer the same way, so neither one tells a caller anything about the other.", "operationId": "SignInSecondFactorsController_complete_v1", "parameters": [ { "in": "header", "name": "user-agent", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "anyOf": [ { "additionalProperties": false, "properties": { "client": { "additionalProperties": false, "properties": { "instanceId": { "maxLength": 120, "minLength": 1, "type": "string" }, "label": { "maxLength": 120, "minLength": 1, "type": "string" }, "type": { "enum": [ "web", "android", "ios", "desktop", "other" ], "type": "string" } }, "required": [ "type" ], "type": "object" }, "code": { "maxLength": 8, "minLength": 6, "pattern": "^\\d+$", "type": "string" }, "ticket": { "maxLength": 512, "minLength": 1, "type": "string" } }, "required": [ "ticket", "code", "client" ], "type": "object" }, { "additionalProperties": false, "properties": { "client": { "additionalProperties": false, "properties": { "instanceId": { "maxLength": 120, "minLength": 1, "type": "string" }, "label": { "maxLength": 120, "minLength": 1, "type": "string" }, "type": { "enum": [ "web", "android", "ios", "desktop", "other" ], "type": "string" } }, "required": [ "type" ], "type": "object" }, "recoveryCode": { "maxLength": 64, "minLength": 1, "type": "string" }, "ticket": { "maxLength": 512, "minLength": 1, "type": "string" } }, "required": [ "ticket", "recoveryCode", "client" ], "type": "object" } ] } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/Envelope" }, { "properties": { "data": { "oneOf": [ { "additionalProperties": false, "properties": { "accessToken": { "type": "string" }, "accessTokenExpiresAt": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" }, "kind": { "enum": [ "session" ], "type": "string" }, "refreshToken": { "type": "string" }, "sessionExpiresAt": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" } }, "required": [ "kind", "accessToken", "accessTokenExpiresAt", "refreshToken", "sessionExpiresAt" ], "type": "object" }, { "additionalProperties": false, "properties": { "kind": { "enum": [ "second_factor_required" ], "type": "string" }, "secondFactorTicket": { "type": "string" }, "ticketExpiresAt": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" } }, "required": [ "kind", "secondFactorTicket", "ticketExpiresAt" ], "type": "object" } ] } }, "type": "object" } ] } } }, "description": "" } }, "summary": "Finish signing in with a second factor", "tags": [ "Identity" ] } }, "/api/v1/sign-outs": { "post": { "description": "Ends the session the presented access token belongs to. Its refresh token stops working immediately, and so does the access token itself: every authenticated request checks that the named session is still live, so this same access token is refused starting with the very next request, not once it naturally expires.", "operationId": "SignOutsController_leave_v1", "parameters": [], "responses": { "204": { "description": "The session is over. Presenting the same access token again does not repeat this response: SessionGuard already refuses it with 401, on the very next request, before this route runs again." } }, "security": [ { "session": [] } ], "summary": "Leave from this client", "tags": [ "Identity" ] } }, "/api/v1/sign-outs/everywhere": { "post": { "description": "Ends every session this identity holds, including the one the presented access token belongs to, so every refresh token and every access token from every device stop working immediately, checked on their very next request. Use this when the account might be compromised.", "operationId": "SignOutsController_leaveEverywhere_v1", "parameters": [], "responses": { "204": { "description": "Every session is over. Presenting the same access token again does not repeat this response: SessionGuard already refuses it with 401, on the very next request, before this route runs again." } }, "security": [ { "session": [] } ], "summary": "Leave from every device", "tags": [ "Identity" ] } }, "/api/v1/sign-ups": { "post": { "description": "Creates a global identity for one email address or phone number and sends it a verification code. The identity exists before the code is sent, so the response says whether the code was delivered.", "operationId": "SignUpsController_register_v1", "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "oneOf": [ { "additionalProperties": false, "properties": { "identifier": { "maxLength": 320, "minLength": 1, "type": "string" }, "identifierType": { "enum": [ "email" ], "type": "string" }, "password": { "maxLength": 200, "minLength": 12, "type": "string" } }, "required": [ "identifierType", "identifier", "password" ], "type": "object" }, { "additionalProperties": false, "properties": { "country": { "maxLength": 2, "minLength": 2, "pattern": "^[A-Z]{2}$", "type": "string" }, "identifier": { "maxLength": 320, "minLength": 1, "type": "string" }, "identifierType": { "enum": [ "phone" ], "type": "string" }, "password": { "maxLength": 200, "minLength": 12, "type": "string" } }, "required": [ "identifierType", "identifier", "country", "password" ], "type": "object" } ] } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/Envelope" }, { "properties": { "data": { "additionalProperties": false, "properties": { "challengeDelivery": { "additionalProperties": false, "properties": { "delivered": { "type": "boolean" }, "resendable": { "type": "boolean" } }, "required": [ "delivered", "resendable" ], "type": "object" }, "challengeExpiresAt": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" } }, "required": [ "challengeExpiresAt", "challengeDelivery" ], "type": "object" } }, "type": "object" } ] } } }, "description": "" } }, "summary": "Register an identity", "tags": [ "Identity" ] } }, "/api/v1/sign-ups/confirmations": { "post": { "description": "Proves the caller holds the identifier by presenting the code that was sent to it. The code is single use, and a wrong one spends one of the attempts the challenge allows.", "operationId": "SignUpConfirmationsController_verify_v1", "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "oneOf": [ { "additionalProperties": false, "properties": { "code": { "maxLength": 12, "minLength": 6, "pattern": "^[0-9A-Za-z]+$", "type": "string" }, "identifier": { "maxLength": 320, "minLength": 1, "type": "string" }, "identifierType": { "enum": [ "email" ], "type": "string" }, "password": { "maxLength": 200, "minLength": 12, "type": "string" } }, "required": [ "identifierType", "identifier", "password", "code" ], "type": "object" }, { "additionalProperties": false, "properties": { "code": { "maxLength": 12, "minLength": 6, "pattern": "^[0-9A-Za-z]+$", "type": "string" }, "country": { "maxLength": 2, "minLength": 2, "pattern": "^[A-Z]{2}$", "type": "string" }, "identifier": { "maxLength": 320, "minLength": 1, "type": "string" }, "identifierType": { "enum": [ "phone" ], "type": "string" }, "password": { "maxLength": 200, "minLength": 12, "type": "string" } }, "required": [ "identifierType", "identifier", "country", "password", "code" ], "type": "object" } ] } } }, "required": true }, "responses": { "204": { "description": "The identifier is verified and the code is spent." } }, "summary": "Verify an identifier with the code it received", "tags": [ "Identity" ] } }, "/api/v1/step-ups": { "post": { "description": "Sends a step-up code to a verified identifier of the calling identity. Answering it with the confirmation route hands back a short-lived elevation token bound to this exact session, required before an act that could hand the account to somebody else, such as removing a sign-in method or disabling a second factor.", "operationId": "StepUpsController_open_v1", "parameters": [], "responses": { "201": { "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/Envelope" }, { "properties": { "data": { "additionalProperties": false, "properties": { "challengeExpiresAt": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" } }, "required": [ "challengeExpiresAt" ], "type": "object" } }, "type": "object" } ] } } }, "description": "" } }, "security": [ { "session": [] } ], "summary": "Start proving this session still belongs to its owner", "tags": [ "Identity" ] } }, "/api/v1/step-ups/confirmations": { "post": { "description": "Answers the code sent by the step-up route and, once proven, hands back a short-lived elevation token bound to the calling session. A wrong code charges an attempt without ending the session; an expired, consumed, or revoked challenge refuses the same way as a wrong code.", "operationId": "StepUpConfirmationsController_confirm_v1", "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "additionalProperties": false, "properties": { "code": { "maxLength": 12, "minLength": 6, "pattern": "^[0-9A-Za-z]+$", "type": "string" } }, "required": [ "code" ], "type": "object" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/Envelope" }, { "properties": { "data": { "additionalProperties": false, "properties": { "elevationToken": { "type": "string" }, "expiresAt": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" } }, "required": [ "elevationToken", "expiresAt" ], "type": "object" } }, "type": "object" } ] } } }, "description": "" } }, "security": [ { "session": [] } ], "summary": "Prove the step-up code and receive an elevation token", "tags": [ "Identity" ] } }, "/api/v1/step-ups/providers": { "post": { "description": "Proves this session is present using a fresh ID token from a provider linked to the calling identity, for an identity that has no verified identifier to send a step-up code to. Verifies the token with the same issuer, audience and signature pinning used at sign-in, requires it to have been issued within the last five minutes, and requires the (provider, subject) it names to belong to the caller through an active sign-in method. On success it hands back the same elevation token as the code-based confirmation route. Every refusal answers the same step-up confirmation refusal, so the response never reveals which check failed.", "operationId": "StepUpProvidersController_confirm_v1", "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "additionalProperties": false, "properties": { "idToken": { "maxLength": 4096, "minLength": 1, "type": "string" }, "provider": { "enum": [ "google", "apple" ], "type": "string" } }, "required": [ "provider", "idToken" ], "type": "object" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/Envelope" }, { "properties": { "data": { "additionalProperties": false, "properties": { "elevationToken": { "type": "string" }, "expiresAt": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" } }, "required": [ "elevationToken", "expiresAt" ], "type": "object" } }, "type": "object" } ] } } }, "description": "" } }, "security": [ { "session": [] } ], "summary": "Step up with a provider-signed ID token", "tags": [ "Identity" ] } }, "/health/live": { "get": { "description": "Reports whether the process itself is running, without checking the database. Documented exception to the { data } envelope and to Problem Details (section 3): this route keeps the raw health-check contract and is filtered through ProtocolExceptionFilter instead of the global error filter.", "operationId": "HealthController_live", "parameters": [], "responses": { "200": { "content": { "application/json": { "schema": { "properties": { "details": { "additionalProperties": { "additionalProperties": true, "properties": { "responseTime": { "description": "Time the health indicator took to respond, in ms", "type": "number" }, "status": { "enum": [ "up", "degraded", "down" ], "type": "string" } }, "required": [ "status" ], "type": "object" }, "example": { "database": { "responseTime": 12, "status": "up" } }, "type": "object" }, "error": { "additionalProperties": { "additionalProperties": true, "properties": { "responseTime": { "description": "Time the health indicator took to respond, in ms", "type": "number" }, "status": { "enum": [ "up", "degraded", "down" ], "type": "string" } }, "required": [ "status" ], "type": "object" }, "example": {}, "nullable": true, "type": "object" }, "info": { "additionalProperties": { "additionalProperties": true, "properties": { "responseTime": { "description": "Time the health indicator took to respond, in ms", "type": "number" }, "status": { "enum": [ "up", "degraded", "down" ], "type": "string" } }, "required": [ "status" ], "type": "object" }, "example": { "database": { "responseTime": 12, "status": "up" } }, "nullable": true, "type": "object" }, "status": { "enum": [ "ok", "degraded" ], "example": "ok", "type": "string" } }, "type": "object" } } }, "description": "The Health Check is successful", "headers": { "X-Request-Id": { "description": "Correlates this HTTP attempt with server logs. Generated by the server; any client-supplied value is ignored.", "schema": { "format": "uuid", "type": "string" } } } }, "503": { "content": { "application/json": { "schema": { "properties": { "details": { "additionalProperties": { "additionalProperties": true, "properties": { "responseTime": { "description": "Time the health indicator took to respond, in ms", "type": "number" }, "status": { "enum": [ "up", "degraded", "down" ], "type": "string" } }, "required": [ "status" ], "type": "object" }, "example": { "database": { "responseTime": 12, "status": "up" }, "redis": { "message": "Could not connect", "responseTime": 3005, "status": "down" } }, "type": "object" }, "error": { "additionalProperties": { "additionalProperties": true, "properties": { "responseTime": { "description": "Time the health indicator took to respond, in ms", "type": "number" }, "status": { "enum": [ "up", "degraded", "down" ], "type": "string" } }, "required": [ "status" ], "type": "object" }, "example": { "redis": { "message": "Could not connect", "responseTime": 3005, "status": "down" } }, "nullable": true, "type": "object" }, "info": { "additionalProperties": { "additionalProperties": true, "properties": { "responseTime": { "description": "Time the health indicator took to respond, in ms", "type": "number" }, "status": { "enum": [ "up", "degraded", "down" ], "type": "string" } }, "required": [ "status" ], "type": "object" }, "example": { "database": { "responseTime": 12, "status": "up" } }, "nullable": true, "type": "object" }, "status": { "enum": [ "error", "shutting_down" ], "example": "error", "type": "string" } }, "type": "object" } } }, "description": "The Health Check is not successful", "headers": { "X-Request-Id": { "description": "Correlates this HTTP attempt with server logs. Generated by the server; any client-supplied value is ignored.", "schema": { "format": "uuid", "type": "string" } } } } }, "summary": "Liveness probe", "tags": [ "health" ] } }, "/health/ready": { "get": { "description": "Reports whether the process can serve traffic, including a database reachability check. Documented exception to the { data } envelope and to Problem Details (section 3): this route keeps the raw health-check contract and is filtered through ProtocolExceptionFilter instead of the global error filter.", "operationId": "HealthController_ready", "parameters": [], "responses": { "200": { "content": { "application/json": { "schema": { "properties": { "details": { "additionalProperties": { "additionalProperties": true, "properties": { "responseTime": { "description": "Time the health indicator took to respond, in ms", "type": "number" }, "status": { "enum": [ "up", "degraded", "down" ], "type": "string" } }, "required": [ "status" ], "type": "object" }, "example": { "database": { "responseTime": 12, "status": "up" } }, "type": "object" }, "error": { "additionalProperties": { "additionalProperties": true, "properties": { "responseTime": { "description": "Time the health indicator took to respond, in ms", "type": "number" }, "status": { "enum": [ "up", "degraded", "down" ], "type": "string" } }, "required": [ "status" ], "type": "object" }, "example": {}, "nullable": true, "type": "object" }, "info": { "additionalProperties": { "additionalProperties": true, "properties": { "responseTime": { "description": "Time the health indicator took to respond, in ms", "type": "number" }, "status": { "enum": [ "up", "degraded", "down" ], "type": "string" } }, "required": [ "status" ], "type": "object" }, "example": { "database": { "responseTime": 12, "status": "up" } }, "nullable": true, "type": "object" }, "status": { "enum": [ "ok", "degraded" ], "example": "ok", "type": "string" } }, "type": "object" } } }, "description": "The Health Check is successful", "headers": { "X-Request-Id": { "description": "Correlates this HTTP attempt with server logs. Generated by the server; any client-supplied value is ignored.", "schema": { "format": "uuid", "type": "string" } } } }, "503": { "content": { "application/json": { "schema": { "properties": { "details": { "additionalProperties": { "additionalProperties": true, "properties": { "responseTime": { "description": "Time the health indicator took to respond, in ms", "type": "number" }, "status": { "enum": [ "up", "degraded", "down" ], "type": "string" } }, "required": [ "status" ], "type": "object" }, "example": { "database": { "responseTime": 12, "status": "up" }, "redis": { "message": "Could not connect", "responseTime": 3005, "status": "down" } }, "type": "object" }, "error": { "additionalProperties": { "additionalProperties": true, "properties": { "responseTime": { "description": "Time the health indicator took to respond, in ms", "type": "number" }, "status": { "enum": [ "up", "degraded", "down" ], "type": "string" } }, "required": [ "status" ], "type": "object" }, "example": { "redis": { "message": "Could not connect", "responseTime": 3005, "status": "down" } }, "nullable": true, "type": "object" }, "info": { "additionalProperties": { "additionalProperties": true, "properties": { "responseTime": { "description": "Time the health indicator took to respond, in ms", "type": "number" }, "status": { "enum": [ "up", "degraded", "down" ], "type": "string" } }, "required": [ "status" ], "type": "object" }, "example": { "database": { "responseTime": 12, "status": "up" } }, "nullable": true, "type": "object" }, "status": { "enum": [ "error", "shutting_down" ], "example": "error", "type": "string" } }, "type": "object" } } }, "description": "The Health Check is not successful", "headers": { "X-Request-Id": { "description": "Correlates this HTTP attempt with server logs. Generated by the server; any client-supplied value is ignored.", "schema": { "format": "uuid", "type": "string" } } } } }, "summary": "Readiness probe", "tags": [ "health" ] } } }, "servers": [], "tags": [] }