Auth
GET
TOTP und Passkeys lassen sich serverweit per TOTP_ENABLED bzw. PASSKEYS_ENABLED abschalten. Abgeschaltet antworten die zugehörigen Endpunkte mit 403 (TOTP_DISABLED / PASSKEYS_DISABLED), und bei der Anmeldung wird ein eingerichtetes TOTP nicht abgefragt.
Verfügbare Anmeldeverfahren
application/json- response
password*booleantotp*booleanpasskeys*booleanoauthProviders*array<>curl -X GET 'https://example.com/api/v1/auth/methods'Example Response200
{ "password": true, "totp": true, "passkeys": true, "oauthProviders": [ "google" ]}POST
application/json- body
identifier*stringpassword*stringFormat
passwordtotpCode?|Match
^[0-9]{6}$deviceName?string|nullErfolgreich angemeldet
application/json- response
accessToken*stringrefreshToken*stringexpiresIn*integertokenType?stringuser*curl -X POST 'https://example.com/api/v1/auth/login' \ -H 'Content-Type: application/json' \ -d '{ "identifier": "string", "password": "pa$$word"}'Example Response
{ "accessToken": "string", "refreshToken": "string", "expiresIn": 0, "tokenType": "Bearer", "user": { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "email": "user@example.com", "loginName": "string", "displayName": "string", "firstName": "string", "lastName": "string", "role": "user", "status": "active", "locale": "de", "timezone": "Europe/Berlin", "themeMode": "light", "totpEnabled": true, "totpRequired": true, "passkeyEnabled": true, "hasPassword": true, "forcePasswordChange": true, "onboardingCompleted": true, "lastLoginAt": "2019-08-24T14:15:22Z", "createdAt": "2019-08-24T14:15:22Z", "updatedAt": "2019-08-24T14:15:22Z" }}POST
application/json- body
refreshToken*stringNeue Tokens
application/json- response
accessToken*stringrefreshToken*stringexpiresIn*integertokenType?stringcurl -X POST 'https://example.com/api/v1/auth/refresh' \ -H 'Content-Type: application/json' \ -d '{ "refreshToken": "string"}'Example Response200
{ "accessToken": "string", "refreshToken": "string", "expiresIn": 0, "tokenType": "Bearer"}POST
bearerAuthheader
AuthorizationBearer <JWT>Abgemeldet
curl -X POST 'https://example.com/api/v1/auth/logout'Example Response204
Empty
POST
bearerAuthheader
AuthorizationBearer <JWT>Alle Sitzungen widerrufen
curl -X POST 'https://example.com/api/v1/auth/logout-all'Example Response204
Empty
POST
application/json- body
email*stringFormat
emailAnfrage angenommen
curl -X POST 'https://example.com/api/v1/auth/password/forgot' \ -H 'Content-Type: application/json' \ -d '{ "email": "user@example.com"}'Example Response202
Empty
POST
application/json- body
token*stringpassword*stringFormat
passwordLength
8 <= lengthPasswort geändert
curl -X POST 'https://example.com/api/v1/auth/password/reset' \ -H 'Content-Type: application/json' \ -d '{ "token": "string", "password": "pa$$word"}'Example Response200
Empty