Authentication
Mode-aware authentication and session management. Enabled only after setup is complete. API token management — create, list, and revoke tokens for programmatic access.
Returns all API tokens visible to the caller. Admins and owners see all tokens; other roles see only their own.
Authorization
bearer_auth In: header
Query Parameters
Search API tokens
Sort field
Sort direction
Page size
int64Page offset
int64Response Body
application/json
application/json
application/json
curl -X GET "https://example.com/v1/api-tokens"{ "tokens": [ { "created_at": 0, "created_by": "string", "created_by_email": "string", "expires_at": 0, "id": "string", "is_expired": true, "is_revoked": true, "last_used_at": 0, "name": "string", "prefix": "string", "role": "owner" } ], "total": 0}Creates a new API token. The plaintext token is returned only in this response and cannot be retrieved again.
Authorization
bearer_auth In: header
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/api-tokens" \ -H "Content-Type: application/json" \ -d '{ "name": "string", "role": "string" }'{ "created_at": 0, "expires_at": 0, "id": "string", "name": "string", "prefix": "string", "role": "string", "token": "string"}Revokes an API token by ID. Non-admin users can only revoke their own tokens.
Authorization
bearer_auth In: header
Path Parameters
API token ID
Response Body
application/json
application/json
application/json
application/json
curl -X DELETE "https://example.com/v1/api-tokens/string"{ "revoked": true}In Local Only mode, creates a loopback local session and may auto-finalize
first-run owner bootstrap. In Ready External Access mode, every request
requires a short-lived, single-use recovery capability minted by the
local oore recovery command over the daemon's Unix management socket.
TCP loopback and forwarding headers do not grant recovery authority.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
curl -X POST "https://example.com/v1/auth/local/login" \ -H "Content-Type: application/json" \ -d '{}'{ "expires_at": 0, "session_token": "string", "user": { "avatar_url": "string", "email": "string", "oidc_subject": "string", "role": null, "user_id": "string" }}Invalidates the current session.
Authorization
bearer_auth In: header
Response Body
application/json
curl -X POST "https://example.com/v1/auth/logout"{ "ok": true}Exchanges the authorization code for tokens and creates a session.
Request Body
application/json
Authorization code and state from OIDC provider
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
curl -X POST "https://example.com/v1/auth/oidc/callback" \ -H "Content-Type: application/json" \ -d '{ "code": "string", "state": "string" }'{ "expires_at": 0, "session_token": "string", "user": { "avatar_url": "string", "email": "string", "oidc_subject": "string", "role": null, "user_id": "string" }}Initiates the OIDC authorization code flow for user login. Only available after setup is complete.
Query Parameters
Frontend callback URL
Response Body
application/json
application/json
application/json
curl -X GET "https://example.com/v1/auth/oidc/start?redirect_uri=string"{ "authorization_url": "string", "state": "string"}Creates a session from trusted proxy identity headers when remote auth mode is configured to trusted proxy.
Response Body
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/auth/trusted-proxy/login"{ "expires_at": 0, "session_token": "string", "user": { "avatar_url": "string", "email": "string", "oidc_subject": "string", "role": null, "user_id": "string" }}