Authentication
Registration, login, session, email verification, magic links.
Initialize the CSRF cookie (SPA flow)
Sets the `XSRF-TOKEN` cookie used by the stateful SPA login flow. Call
Register a new tenant and its first admin user
Creates a tenant and its first admin user in a single transaction, logs
Log in (SPA cookie session)
Authenticates the GLOBAL account (its password is the sole credential —
Complete a pending multi-tenant login
Completes a login that was deferred because the account belongs to more
The signed-in device account's workspaces (bearer token)
The phone's twin of `GET /me/memberships`, which needs a cookie session.
Switch the phone to another workspace of the same account
Mints a token for the same account's active seat in `tenant_id` and
Switch the active tenant of the authenticated session
Re-points the authenticated session at another tenant the SAME account
What the signed-in member may have and do (evaluated)
The one capability answer the panel, the mobile app and the API share
List the current account's active tenant memberships
The active memberships of the account behind the current session, with
Log in for a native / mobile device (bearer token)
Bearer-token login for native / mobile (Capacitor) clients (Faz 0 /
Register a new tenant from a native / mobile device (bearer token)
The token twin of `/api/register` (E7.10): same fields, same promo-card
List the acting user's device tokens
The acting user's personal access tokens (devices). Works under EITHER
Sign out every other device
Revokes ALL of the acting user's device tokens EXCEPT the one making this
Revoke a single device token
Revokes one of the acting user's device tokens. The token must belong to
List the acting user's push subscriptions
The acting user's push subscriptions (Faz 0 / Dilim 2). Works under EITHER
Register a device push subscription
Register (UPSERT) a device push subscription for the acting user. Keyed by
Remove a device push subscription
Remove one of the acting user's push subscriptions (native logout / opt-out).
OneSignal config (client-safe)
The CLIENT-SAFE OneSignal config so the web/native SDK can init (Faz 2/3).
Create a new workspace for the current account
Creates a NEW tenant owned + administered by the CURRENT account (Faz 5E).
Log out and invalidate the session
Log out and invalidate the session
Lock the panel (screen lock)
Marks the CURRENT session locked. From that point the API answers `423`
Open the screen lock with the account PIN
Lifts the lock from the SAME session — it never establishes one. Every
Set or change the screen-lock PIN
PASSWORD-CONFIRMED, every time. Without it, somebody at an unlocked
Remove the screen-lock PIN
Password-confirmed for the same reason as setting it.
Get the authenticated user
Returns the signed-in user, including its tenant id and locale. The SPA
Request a password-reset link
Request a password-reset link
Reset the password with a token
Reset the password with a token
Request a passwordless magic-link sign-in email
Request a passwordless magic-link sign-in email
Resend the email-verification notification
Resend the email-verification notification
Resend the ACCOUNT (global identity) email-verification notification
Re-sends the verification link to the CURRENT account (resolved from the authenticated session, never the request body). Idempotent: an already-verified account returns 200 with a message and no mail is sent. Rate-limited against resend spam.
Verify a global account email via a signed link
Consumes a temporary SIGNED link (the SPA /verify-email page forwards the full signed query here so the signature stays valid). RLS-free / global — no tenant context. Idempotent: an already-verified account returns 200.