Authentication API

8 endpoints. Request and response schemas are described on the schemas page; the other tags are listed in the API index.

Endpoints

POST /api/v1/auth/change-password

Change password

Change the password for the current user

Request body (required)

application/json: object

Field	Type	Required	Description
current_password	string	yes	-
new_password	string	yes	-

Responses

Status	Description	Body
204	Password changed successfully, no content	-
400	Invalid request	-
401	Not authenticated or invalid current password	-

POST /api/v1/auth/login

Login

Authenticate with username and password

Authentication: none (public endpoint).

Request body (required)

application/json: object

Field	Type	Required	Description
password	string	yes	-
username	string	yes	-

Responses

Status	Description	Body
200	Login successful, returns user object	application/json: User
400	Invalid request	application/json: Error
401	Invalid credentials	-
415	Unsupported media type	application/json: Error
429	Too many requests	application/json: Error

POST /api/v1/auth/logout

Logout

Logout the current user (same-origin only). Sessions created by an OIDC provider whose IdP advertises an end_session_endpoint get 200 with the RP-initiated logout URL to navigate to.

Responses

Status	Description	Body
200	Logged out locally; continue at the IdP	application/json: EndSessionResponse
204	Logout successful, no content	-
403	Cross-site request rejected	application/json: Error

GET /api/v1/auth/me

Get current user

Returns information about the currently authenticated user

Responses

Status	Description	Body
200	Current user information	application/json: UserExtended
401	Not authenticated	-

GET /api/v1/auth/sso/providers

List SSO providers

List available SSO providers (public)

Authentication: none (public endpoint).

Responses

Status	Description	Body
200	List of SSO providers	application/json: object

Fields of the 200 response (application/json):

Field	Type	Required	Description
providers	array of object	yes	-
providers[].display_name	string	no	-
providers[].kind	string	no	One of: oidc, saml.
providers[].slug	string	no	-

GET /api/v1/auth/tokens

List own API tokens

List API tokens for the current user

Responses

Status	Description	Body
200	List of tokens	application/json: object
403	Forbidden	application/json: Error

Fields of the 200 response (application/json):

Field	Type	Required	Description
data	array of Token	no	-

POST /api/v1/auth/tokens

Create own API token

Create a new API token for the current user

Request body (required)

application/json: object

Field	Type	Required	Description
expires_at	string (date-time)	no	-
kind	string	yes	One of: access, deploy.
name	string	yes	-
scopes	array of string	no	-

Responses

Status	Description	Body
201	Token created	application/json: TokenCreateResponse
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	Forbidden	application/json: Error

DELETE /api/v1/auth/tokens/{id}

Revoke own API token

Revoke an API token for the current user

Parameters

Name	In	Type	Required	Description
id	path	string (uuid)	yes	-

Responses

Status	Description	Body
204	Token revoked	-
400	Invalid request, including a NUL byte in the URL or the body	application/json: Error
403	Forbidden	application/json: Error
404	Token not found	-