Auth and account

Registering, signing in, refreshing, two-factor, verification, passwords and personal notification preferences.

Method	Path	Needs	Returns
POST	/auth/register	public	201 { userId, organizationId, session }
POST	/auth/login	public	{ userId, session } or { mfaRequired, challengeToken }
POST	/auth/mfa	public	{ challengeToken, code } → { userId, session }
POST	/auth/refresh	public	{ session }, rotated
POST	/auth/logout	public	204, idempotent
GET	/users/me	authenticated	{ id, email, emailVerified, createdAt }
GET	/account/2fa	authenticated	{ enabled, enabledAt, recoveryCodesRemaining }
POST	/account/2fa/setup	authenticated	{ secret, otpauthUrl }
POST	/account/2fa/enable	authenticated	{ recoveryCodes[10] }, once
POST	/account/2fa/disable	authenticated	{ password, code }
POST	/account/2fa/recovery-codes	authenticated	ten new codes
POST	/account/verify-email/request	authenticated	202, at most five an hour
POST	/account/verify-email	public	{ token } → { verified: true }
POST	/account/password/forgot	public	202, always
POST	/account/password/reset	public	{ token, password }; revokes every session
POST	/account/password/change	authenticated	revokes every session
GET	/account/notifications	authenticated	your preferences in this organization
PATCH	/account/notifications	authenticated	{ instantEmail?, digestEmail?, minSeverity? }

A session is { accessToken, tokenType, expiresIn, refreshToken, refreshTokenExpiresAt }. Passwords are at least ten characters and hashed with Argon2id. The forgot-password route answers 202 whether or not the address exists.

Something here wrong, missing or out of date? Tell us and we will fix the page.