Request token
Request authenticated token
Register login
Register a new login
Verify login registration
Verify a login registration
Start login
Start a password-less login process
List factors
List authentication factors
Register factor
Register an authentication factor
Verify factor registration
Verify an authentication factor registration
Start factor challenge
Issue a factor verification challenge for a pending MFA round. Authenticated via the short-lived mfachallengeid in the body, not by session — this is the only /auth/factors/* route that does not require an authenticated session.
Start mfa challenge
Mint a fresh MFA challenge for the current authenticated session so the SPA can satisfy a stepuprequired denial. Optionally filters eligible factors against an inbound StepUpRequirement hint. Returns enrollment_required when no enrolled factor matches the requirement so the SPA can route the user into enrollment instead of getting stuck.
Remove factor
Remove one of the caller's own factors. Answered only for authenticator today, and only after a recent strong-factor verification: the same gate enrolment sits behind once a strong factor exists, so a stolen session cannot quietly switch the second factor off. Removing the last authenticator turns the sign-in challenge off for that account.
Logout
revoke the caller's current session (self sign-out). Deliberately carries no policy gate: signing out must always clear the browser's httpOnly refresh cookie, including for a caller whose access token has already expired. A 401 here would leave a 30-day refresh cookie behind that silently signs the user back in on the next page load. SessionsService revokes the session only when the caller is actually authenticated; an anonymous caller still gets 204 and a cleared cookie.
Read session
Who the caller is and which platform roles they hold