SchemaVaults Auth API

v0.46.2OpenAPI 3.1.0

HTTP API of SchemaVaults Auth, SchemaVaults' own instance of @schemavaults/auth-server: authentication and OpenID Connect endpoints, account and organization management, client application and API server registrations, and platform administration. Every operation is declared with @schemavaults/openapi-operations; this document and the /docs pages are generated from those declarations.

Server
https://auth.schemavaults.com
(This auth server)
Spec
/api/openapi.json

Authentication

How to present credentials to this API. Each operation lists which of these it accepts.

  • Access token (Bearer)schemavaults-access-tokenhttp
    Authorization: Bearer <JWT>

    Access token issued by the auth server for this API server.

    Missing credentials answer with WWW-Authenticate: Bearer realm="schemavaults"

  • JWKS access assertion (Bearer)schemavaults-jwks-access-assertionhttp
    Authorization: Bearer <JWT>

    JWKS access assertion signed by the API server's JWKS access key.

    Missing credentials answer with WWW-Authenticate: Bearer realm="schemavaults-jwks-access"

Authentication

Login, registration, e-mail verification and password reset for the auth server's own login pages and the client SDK.

MethodPath
POST/api/auth/login

Log in with email and password

Public
POST/api/auth/register

Register a new account

Public
POST/api/auth/mfa/verify

Complete a login MFA challenge

Public
POST/api/auth/mfa/webauthn/options

Start a passkey assertion for a login MFA challenge

Public
POST/api/auth/logout/{client_app_id}

Log out of a client application

Public
GET/api/auth/whoami/{client_app_id}

Get the signed-in user

Authenticated
POST/api/auth/session/generate-authorization-code

Issue an authorization code for the current session

Authenticated
POST/api/auth/reset-password/request

Request a password reset e-mail

Public
POST/api/auth/reset-password/confirm

Reset the password with an e-mailed token

Public
POST/api/auth/verify-email/request

Request a verification e-mail

Public
POST/api/auth/verify-email/confirm

Confirm an e-mail address with an e-mailed token

Public

Multi-factor authentication

TOTP and passkey (WebAuthn) enrollment, the login MFA challenge, and recovery codes.

MethodPath
GET/api/user/mfa/status

Get my MFA status

Authenticated
GET/api/user/mfa/status/{factor_type}

Get my status for one MFA factor type

Authenticated
POST/api/user/mfa/totp/enroll

Start a TOTP enrollment

Authenticated
POST/api/user/mfa/totp/verify-enrollment

Confirm a TOTP enrollment

Authenticated
DELETE/api/user/mfa/totp/{factor_id}

Remove a TOTP factor

Authenticated
POST/api/user/mfa/recovery-codes/regenerate

Regenerate my recovery codes

Authenticated
GET/api/user/mfa/webauthn

List my passkeys

Authenticated
POST/api/user/mfa/webauthn/options

Start a passkey enrollment

Authenticated
POST/api/user/mfa/webauthn/verify-enrollment

Confirm a passkey enrollment

Authenticated
POST/api/user/mfa/webauthn/authenticate-options

Start a passkey step-up verification

Authenticated
DELETE/api/user/mfa/webauthn/{factor_id}

Remove a passkey

Authenticated

OpenID Connect / OAuth 2.0

The standards-facing endpoints: discovery, authorization, token, userinfo, introspection, JWKS and dynamic client registration.

MethodPath
GET/api/oidc/openid-configuration

OpenID Provider metadata (discovery)

Public
GET/api/oidc/jwks

id_token verification keys (JWKS)

Public
GET/api/oidc/authorize

Authorization endpoint

Public
POST/api/oidc/token

Token endpoint

Public
GET/api/oidc/userinfo

Userinfo endpoint

Public
POST/api/oidc/userinfo

Userinfo endpoint (POST)

Public
POST/api/oidc/introspect

Token introspection

Public
POST/api/oidc/register

Dynamic client registration

Public

Account

The signed-in user's own profile, organization memberships and invitations.

MethodPath
GET/api/user/profile

Get my profile

Authenticated
PUT/api/user/profile

Replace my profile

Authenticated
GET/api/me/organizations

List my organization memberships

Authenticated
GET/api/me/organizations/{organization_id}/role

Get my role in an organization

Authenticated
GET/api/user/organizations

List my organizations

Authenticated
GET/api/me/invitations

List my pending organization invitations

Authenticated

Client applications

Client application (OAuth client) registrations and their configuration: domains, callback URLs, client secrets, service accounts, user authorization.

MethodPath
GET/api/apps

List client applications

Authenticated
POST/api/apps

Create a client application

Authenticated
GET/api/apps/{app_id}

Get a client application

Authenticated
DELETE/api/apps/{app_id}

Delete a client application

Authenticated
GET/api/apps/{app_id}/check-authorization

Check whether the caller authorized an app

Authenticated
POST/api/apps/{app_id}/authorize

Authorize a client application

Authenticated
GET/api/apps/{app_id}/domains

List an app's domains

Authenticated
POST/api/apps/{app_id}/domains

Add a domain to an app

Authenticated
GET/api/apps/{app_id}/callback-urls

List an app's callback URLs

Authenticated
POST/api/apps/{app_id}/callback-urls

Add a callback URL to an app

Authenticated
DELETE/api/apps/{app_id}/callback-urls/{app_callback_url_ref_id}

Remove a callback URL from an app

Authenticated
GET/api/apps/{app_id}/client-secret

Get client secret metadata

Authenticated
POST/api/apps/{app_id}/client-secret

Generate a client secret

Authenticated
PUT/api/apps/{app_id}/client-secret

Rotate a client secret

Authenticated
DELETE/api/apps/{app_id}/client-secret

Remove a client secret

Authenticated
GET/api/apps/{app_id}/service-account

Get an app's service account

Authenticated
POST/api/apps/{app_id}/service-account

Create an app's service account

Authenticated
DELETE/api/apps/{app_id}/service-account

Remove an app's service account

Authenticated

API servers

API server (resource server) registrations, their domains, JWKS access keys and app connections.

MethodPath
GET/api/apis

List API servers

Authenticated
POST/api/apis

Register an API server

Authenticated
GET/api/apis/{api_server_id}

Get an API server

Authenticated
PATCH/api/apis/{api_server_id}

Update an API server's dynamic-client policy

Authenticated
DELETE/api/apis/{api_server_id}

Delete an API server

Authenticated
GET/api/apis/{api_server_id}/domains

List an API server's domains

Authenticated
POST/api/apis/{api_server_id}/domains

Add a domain to an API server

Authenticated
GET/api/apis/{api_server_id}/connect_app/{client_app_id}

Check whether an app is connected to an API server

Authenticated
POST/api/apis/{api_server_id}/connect_app/{client_app_id}

Connect an app to an API server

Authenticated
DELETE/api/apis/{api_server_id}/connect_app/{client_app_id}

Disconnect an app from an API server

Authenticated
GET/api/apis/{api_server_id}/jwks-access-key

Get JWKS access key metadata

Authenticated
POST/api/apis/{api_server_id}/jwks-access-key

Generate a JWKS access key

Authenticated
PUT/api/apis/{api_server_id}/jwks-access-key

Regenerate a JWKS access key

Authenticated

Organizations

Organizations, their members and invitations.

MethodPath
GET/api/organizations

List every organization

Admin
POST/api/organizations

Create an organization

Authenticated
DELETE/api/organizations/{organization_id}

Delete an organization

Authenticated
GET/api/organizations/{organization_id}/members

List an organization's members

Authenticated
GET/api/organizations/{organization_id}/members/{uid}/role

Get a member's role

Authenticated
PATCH/api/organizations/{organization_id}/members/{uid}/role

Change a member's role

Authenticated
GET/api/organizations/{organization_id}/invitations

List an organization's invitations

Authenticated
POST/api/organizations/{organization_id}/invitations

Invite a user to an organization

Authenticated
PATCH/api/organizations/{organization_id}/invitations/{invitation_id}

Accept or decline an invitation

Authenticated
DELETE/api/organizations/{organization_id}/invitations/{invitation_id}

Revoke an invitation

Authenticated

Administration

Platform administrator operations: users, invite codes, settings, branding, diagnostics.

MethodPath
GET/api/admin/users/list

List every user

Admin
DELETE/api/admin/users/{uid}

Delete a user

Admin
POST/api/admin/users/{uid}/disable

Disable a user

Admin
DELETE/api/admin/users/{uid}/disable

Re-enable a user

Admin
GET/api/admin/users/{uid}/mfa

List a user's MFA factor types

Admin
DELETE/api/admin/users/{uid}/mfa

Reset a user's MFA

Admin
POST/api/admin/users/{uid}/resend-verification

Resend a user's verification e-mail

Admin
GET/api/admin/users/{uid}/tokens

List a user's issued tokens

Admin
POST/api/admin/promote/{uid}

Promote a user to administrator

Admin
GET/api/admin/invite-codes

List invite codes

Admin
POST/api/admin/invite-codes

Create an invite code

Admin
GET/api/admin/invite-codes/{invite_code}/usages

Count invite code usages

Admin
GET/api/admin/settings

List server settings

Admin
PATCH/api/admin/settings/{key}

Update a server setting

Admin
GET/api/admin/branding

List branding asset slots

Admin
PUT/api/admin/branding/{asset}

Upload a branding asset

Admin
DELETE/api/admin/branding/{asset}

Remove a custom branding asset

Admin
DELETE/api/admin/errors

Delete captured errors before a cutoff

Admin
DELETE/api/admin/errors/{error_id}

Delete a captured error

Admin
GET/api/admin/server-traces

List recent server traces

Admin
GET/api/admin/server-traces/operations

List traced operations

Admin
GET/api/admin/send-daily-report

Send the daily admin report

Admin
POST/api/admin/send-daily-report

Send the daily admin report (POST)

Admin

Resource servers

Endpoints resource servers call on their own behalf with a JWKS access assertion: signing keys, allowed origins, membership lookups.

MethodPath
GET/api/jwks/{audience}

Load an API server's JWKS

Authenticated
GET/api/resource-server/apis/{api_server_id}/allowed-origins

List a resource server's allowed CORS origins

Authenticated
GET/api/resource-server/organizations/{organization_id}/members/{uid}/role

Look up a user's organization role

Public

Configuration

Public deployment configuration (environment, branding, invite code policy).

MethodPath
GET/api/environment

Deployment environment

Public
GET/api/config/branding

White-label branding

Public
GET/api/config/invite_code_required

Invite code policy

Public
SchemaVaults Auth API reference