List API keys
The signed-in account's API keys, newest first, including revoked and expired ones so the list says what was withdrawn and when
Create API key
Issue a new API key for the signed-in account. The token is in this response and nowhere else, ever. Once the account has a strong second factor, this needs one verified in the last five minutes
Rotate API key
Give a key a new token, so the old one stops working at once. The key keeps its name, scopes and expiry. Needs the same recent second factor as creating one
Revoke API key
Revoke a key. Every request made with it is refused from the next one on. The key stays in the list, marked revoked
Request token
Request authenticated token
Register login
Register a new login
Verify login registration
Verify a login registration
Start login
Start a password-less login process
List sign-in providers
The identity providers the sign-in page offers beside a password, in the order the operator listed them. Empty when none is set up
List factors
List authentication factors
Register factor
Register an authentication factor
Set password
Set or change the caller's own password. Needs the current one when there is one, unless a sign-in link was used in the last ten minutes, and a recent strong-factor verification once an authenticator or passkey is enrolled. Every other session of the account is signed out, and the account's email addresses are told.
Verify factor registration
Verify an authentication factor registration
Start factor challenge
Issue a factor verification challenge for a pending MFA round. Authenticated via the short-lived mfachallengeid in the body, not by session — this is the only /auth/factors/* route that does not require an authenticated session.
Start MFA challenge
Mint a fresh MFA challenge for the current authenticated session so the SPA can satisfy a stepuprequired denial. Optionally filters eligible factors against an inbound StepUpRequirement hint. Returns enrollment_required when no enrolled factor matches the requirement so the SPA can route the user into enrollment instead of getting stuck.
Remove factor
Remove one of the caller's own factors. Answered for authenticator and oidc, and only after a recent strong-factor verification: the same gate enrolment sits behind once a strong factor exists, so a stolen session cannot quietly switch the second factor off. Removing the last authenticator turns the sign-in challenge off for that account. A linked identity provider that is the account's only way to sign in is refused with 409.
Logout
revoke the caller's current session (self sign-out). Deliberately carries no policy gate: signing out must always clear the browser's httpOnly refresh cookie, including for a caller whose access token has already expired. A 401 here would leave a 30-day refresh cookie behind that silently signs the user back in on the next page load. SessionsService revokes the session only when the caller is actually authenticated; an anonymous caller still gets 204 and a cleared cookie.
Read session
Who the caller is and which platform roles they hold