Sessions & credentials

POST change email

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

newEmail*string

The new email address to set must be a valid email address

callbackURL?string

The URL to redirect to after email verification

`application/json`

curl -X POST "https://example.com/api/auth/change-email" \  -H "Content-Type: application/json" \  -d '{    "newEmail": "string"  }'

{  "user": {    "id": "string",    "name": "string",    "email": "string",    "emailVerified": false,    "image": "string",    "createdAt": "2019-08-24T14:15:22Z",    "updatedAt": "2019-08-24T14:15:22Z",    "role": "string",    "banned": false,    "banReason": "string",    "banExpires": "2019-08-24T14:15:22Z",    "twoFactorEnabled": false  },  "status": true,  "message": "Email updated"}

POST change password

Change the password of the user

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

newPassword*string

The new password to set

currentPassword*string

The current password is required

revokeOtherSessions?boolean

Must be a boolean value

`application/json`

curl -X POST "https://example.com/api/auth/change-password" \  -H "Content-Type: application/json" \  -d '{    "newPassword": "string",    "currentPassword": "string"  }'

{  "token": "string",  "user": {    "id": "string",    "email": "user@example.com",    "name": "string",    "image": "http://example.com",    "emailVerified": true,    "createdAt": "2019-08-24T14:15:22Z",    "updatedAt": "2019-08-24T14:15:22Z"  }}

POST delete user

Delete the user

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

callbackURL?string

The callback URL to redirect to after the user is deleted

password?string

The user's password. Required if session is not fresh

token?string

The deletion verification token

`application/json`

curl -X POST "https://example.com/api/auth/delete-user" \  -H "Content-Type: application/json" \  -d '{}'

{  "success": true,  "message": "User deleted"}

GET delete user callback

Callback to complete user deletion with verification token

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

Query Parameters

token?string

The token to verify the deletion request

callbackURL?string

The URL to redirect to after deletion

`application/json`

curl -X GET "https://example.com/api/auth/delete-user/callback"

{  "success": true,  "message": "User deleted"}

GET get session

Get the current session

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

`application/json`

curl -X GET "https://example.com/api/auth/get-session"

{  "session": {    "id": "string",    "expiresAt": "2019-08-24T14:15:22Z",    "token": "string",    "createdAt": "2019-08-24T14:15:22Z",    "updatedAt": "2019-08-24T14:15:22Z",    "ipAddress": "string",    "userAgent": "string",    "userId": "string",    "activeOrganizationId": "string",    "impersonatedBy": "string"  },  "user": {    "id": "string",    "name": "string",    "email": "string",    "emailVerified": false,    "image": "string",    "createdAt": "2019-08-24T14:15:22Z",    "updatedAt": "2019-08-24T14:15:22Z",    "role": "string",    "banned": false,    "banReason": "string",    "banExpires": "2019-08-24T14:15:22Z",    "twoFactorEnabled": false  }}

POST get session

Get the current session

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

`application/json`

curl -X POST "https://example.com/api/auth/get-session" \  -H "Content-Type: application/json" \  -d '{}'

{  "session": {    "id": "string",    "expiresAt": "2019-08-24T14:15:22Z",    "token": "string",    "createdAt": "2019-08-24T14:15:22Z",    "updatedAt": "2019-08-24T14:15:22Z",    "ipAddress": "string",    "userAgent": "string",    "userId": "string",    "activeOrganizationId": "string",    "impersonatedBy": "string"  },  "user": {    "id": "string",    "name": "string",    "email": "string",    "emailVerified": false,    "image": "string",    "createdAt": "2019-08-24T14:15:22Z",    "updatedAt": "2019-08-24T14:15:22Z",    "role": "string",    "banned": false,    "banReason": "string",    "banExpires": "2019-08-24T14:15:22Z",    "twoFactorEnabled": false  }}

GET list accounts

List all accounts linked to the user

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

`application/json`

curl -X GET "https://example.com/api/auth/list-accounts"

[  {    "id": "string",    "providerId": "string",    "createdAt": "2019-08-24T14:15:22Z",    "updatedAt": "2019-08-24T14:15:22Z",    "accountId": "string",    "userId": "string",    "scopes": [      "string"    ]  }]

GET list sessions

List all active sessions for the user

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

`application/json`

curl -X GET "https://example.com/api/auth/list-sessions"

[  {    "id": "string",    "expiresAt": "2019-08-24T14:15:22Z",    "token": "string",    "createdAt": "2019-08-24T14:15:22Z",    "updatedAt": "2019-08-24T14:15:22Z",    "ipAddress": "string",    "userAgent": "string",    "userId": "string",    "activeOrganizationId": "string",    "impersonatedBy": "string"  }]

GET ok

Check if the API is working

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

`application/json`

curl -X GET "https://example.com/api/auth/ok"

{  "ok": true}

POST request password reset

Send a password reset email to the user

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

email*string

The email address of the user to send a password reset email to

redirectTo?string

The URL to redirect the user to reset their password. If the token isn't valid or expired, it'll be redirected with a query parameter ?error=INVALID_TOKEN. If the token is valid, it'll be redirected with a query parameter `?token=VALID_TOKEN

Response Body

`application/json`

curl -X POST "https://example.com/api/auth/request-password-reset" \  -H "Content-Type: application/json" \  -d '{    "email": "string"  }'

{  "status": true,  "message": "string"}

POST reset password

Reset the password for a user

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

newPassword*string

The new password to set

token?string

The token to reset the password

Response Body

`application/json`

curl -X POST "https://example.com/api/auth/reset-password" \  -H "Content-Type: application/json" \  -d '{    "newPassword": "string"  }'

{  "status": true}

GET reset password token

Redirects the user to the callback URL with the token

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

Path Parameters

token*string

The token to reset the password

Query Parameters

callbackURL*string

The URL to redirect the user to reset their password

Response Body

`application/json`

curl -X GET "https://example.com/api/auth/reset-password/string?callbackURL=string"

{  "token": "string"}

POST revoke other sessions

Revoke all other sessions for the user except the current one

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

`application/json`

curl -X POST "https://example.com/api/auth/revoke-other-sessions" \  -H "Content-Type: application/json" \  -d '{}'

{  "status": true}

POST revoke session

Revoke a single session

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

token*string

The token to revoke

Response Body

`application/json`

curl -X POST "https://example.com/api/auth/revoke-session" \  -H "Content-Type: application/json" \  -d '{    "token": "string"  }'

{  "status": true}

POST revoke sessions

Revoke all sessions for the user

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

`application/json`

curl -X POST "https://example.com/api/auth/revoke-sessions" \  -H "Content-Type: application/json" \  -d '{}'

{  "status": true}

POST send verification email

Send a verification email to the user

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

email*string

The email to send the verification email to

callbackURL?string

The URL to use for email verification callback

Response Body

`application/json`

curl -X POST "https://example.com/api/auth/send-verification-email" \  -H "Content-Type: application/json" \  -d '{    "email": "string"  }'

{  "status": true}

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

email*string

Email of the user

password*string

Password of the user

callbackURL?string

Callback URL to use as a redirect for email verification

rememberMe?boolean

If this is false, the session will not be remembered. Default is true.

Response Body

`application/json`

curl -X POST "https://example.com/api/auth/sign-in/email" \  -H "Content-Type: application/json" \  -d '{    "email": "string",    "password": "string"  }'

{  "redirect": false,  "token": "string",  "url": "string",  "user": {    "id": "string",    "name": "string",    "email": "string",    "emailVerified": false,    "image": "string",    "createdAt": "2019-08-24T14:15:22Z",    "updatedAt": "2019-08-24T14:15:22Z",    "role": "string",    "banned": false,    "banReason": "string",    "banExpires": "2019-08-24T14:15:22Z",    "twoFactorEnabled": false  }}

POST sign out

Sign out the current user

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

callbackURL?string

The URL to redirect to after provider logout

disableRedirect?boolean

Return the provider logout URL without redirecting

state?string

State to pass to the provider logout endpoint

Response Body

`application/json`

curl -X POST "https://example.com/api/auth/sign-out" \  -H "Content-Type: application/json" \  -d '{}'

{  "success": true,  "url": "string",  "redirect": true}

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

name*string

The name of the user

email*string

The email of the user

password*string

The password of the user

image?string

The profile image URL of the user

callbackURL?string

The URL to use for email verification callback

rememberMe?boolean

If this is false, the session will not be remembered. Default is true.

Response Body

`application/json`

curl -X POST "https://example.com/api/auth/sign-up/email" \  -H "Content-Type: application/json" \  -d '{    "name": "string",    "email": "string",    "password": "string"  }'

{  "token": "string",  "user": {    "id": "string",    "email": "user@example.com",    "name": "string",    "image": "http://example.com",    "emailVerified": true,    "createdAt": "2019-08-24T14:15:22Z",    "updatedAt": "2019-08-24T14:15:22Z"  }}

POST update session

Update the current session

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

[key: string]?unknown

Response Body

`application/json`

curl -X POST "https://example.com/api/auth/update-session" \  -H "Content-Type: application/json" \  -d '{    "property1": null,    "property2": null  }'

{  "session": {    "id": "string",    "expiresAt": "2019-08-24T14:15:22Z",    "token": "string",    "createdAt": "2019-08-24T14:15:22Z",    "updatedAt": "2019-08-24T14:15:22Z",    "ipAddress": "string",    "userAgent": "string",    "userId": "string",    "activeOrganizationId": "string",    "impersonatedBy": "string"  }}

POST update user

Update the current user

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

name?string

The name of the user

image?string

The image of the user

Response Body

`application/json`

curl -X POST "https://example.com/api/auth/update-user" \  -H "Content-Type: application/json" \  -d '{}'

{  "user": {    "id": "string",    "name": "string",    "email": "string",    "emailVerified": false,    "image": "string",    "createdAt": "2019-08-24T14:15:22Z",    "updatedAt": "2019-08-24T14:15:22Z",    "role": "string",    "banned": false,    "banReason": "string",    "banExpires": "2019-08-24T14:15:22Z",    "twoFactorEnabled": false  }}

GET verify email

Verify the email of the user

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

Query Parameters

token*string

The token to verify the email

callbackURL?string

The URL to redirect to after email verification

Response Body

`application/json`

curl -X GET "https://example.com/api/auth/verify-email?token=string"

{  "user": {    "id": "string",    "name": "string",    "email": "string",    "emailVerified": false,    "image": "string",    "createdAt": "2019-08-24T14:15:22Z",    "updatedAt": "2019-08-24T14:15:22Z",    "role": "string",    "banned": false,    "banReason": "string",    "banExpires": "2019-08-24T14:15:22Z",    "twoFactorEnabled": false  },  "status": true}

POST verify password

Verify the current user's password

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

password*string

The password to verify

Response Body

`application/json`

curl -X POST "https://example.com/api/auth/verify-password" \  -H "Content-Type: application/json" \  -d '{    "password": "string"  }'

{  "status": true}

200application/json

400application/json

401application/json

403application/json

404application/json

429application/json

500application/json

200application/json

400application/json

401application/json

403application/json

404application/json

429application/json

500application/json

200application/json

400application/json

401application/json

403application/json

404application/json

429application/json

500application/json

200application/json

400application/json

401application/json

403application/json

404application/json

429application/json

500application/json

200application/json

400application/json

401application/json

403application/json

404application/json

429application/json

500application/json

200application/json

400application/json

401application/json

403application/json

404application/json

429application/json

500application/json

200application/json

400application/json

401application/json

403application/json

404application/json

429application/json

500application/json

200application/json

400application/json

401application/json

403application/json

404application/json

429application/json

500application/json

200application/json

400application/json

401application/json

403application/json

404application/json

429application/json

500application/json

200application/json

400application/json

401application/json

403application/json

404application/json

429application/json

500application/json

200application/json

400application/json

401application/json

403application/json

404application/json

429application/json

500application/json

200application/json

400application/json

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`