Auth
Who is asking: sign-in, API keys, permissions and groups for every part on the platform.
glueRunning the shop71 operationsid auth
How it sits
Glue chains parts together and keeps the result running. The counts and the links below are from the platform's spec and the other services' own descriptions.
What it can do
71 operations in 14 resources, as the spec declares them. Each row is one call; paths are relative to the part.
auth
| Method | Path | Does |
|---|---|---|
| GET | /auth/change-password | Change password form |
| POST | /auth/change-password | Change password |
| GET | /auth/dashboard | User service dashboard |
| POST | /auth/forgot-password | Request a password reset email |
| POST | /auth/kiosk-token | Mint a device-bound kiosk token for a provisioned principal |
| GET | /auth/login | Login page |
| POST | /auth/login | Authenticate with email and password |
| GET | /auth/logout | Clear session and logout |
| POST | /auth/magic-consume | Consume a magic link and start a session |
| POST | /auth/magic-link | Email a one-time passwordless login link |
| POST | /auth/mfa/sms/disable | Turn off SMS 2FA |
| POST | /auth/mfa/sms/enable | Confirm the texted code and turn on SMS 2FA |
| POST | /auth/mfa/sms/start | Text a code to begin SMS 2FA setup |
| GET | /auth/mfa/status | Current user's 2FA status |
| POST | /auth/mfa/totp/disable | Turn off TOTP |
| POST | /auth/mfa/totp/enable | Confirm and activate TOTP |
| POST | /auth/mfa/totp/setup | Begin TOTP enrollment |
| POST | /auth/mfa/verify | Complete MFA and start a session |
| POST | /auth/refresh | Refresh access token |
| POST | /auth/register | Register a new user |
| POST | /auth/reset-password | Set a new password using a reset token |
| POST | /auth/sms-code | Text a one-time sign-in code to a phone |
| POST | /auth/sms-login | Sign in with a phone number and texted code |
| GET | /auth/verify | Verify session authentication |
24 operations
users
| Method | Path | Does |
|---|---|---|
| GET | /api/v1/users | List Users |
| POST | /api/v1/users | Create User |
| GET | /api/v1/users/me | Get Me |
| POST | /api/v1/users/me/tenants/switch | Switch the active tenant |
| DELETE | /api/v1/users/{user_id} | Deactivate User |
| GET | /api/v1/users/{user_id} | Get User |
| PATCH | /api/v1/users/{user_id} | Update User |
| GET | /api/v1/users/{user_id}/activity | User Activity |
| POST | /api/v1/users/{user_id}/mfa/reset | Clear a user's 2FA enrollment (admin recovery) |
| POST | /api/v1/users/{user_id}/tenants | Grant a user membership in a tenant |
| DELETE | /api/v1/users/{user_id}/tenants/{tenant_slug} | Revoke a tenant membership |
| POST | /api/v1/users/{user_id}/unlock | Clear lockout state for a user |
12 operations
groups
| Method | Path | Does |
|---|---|---|
| GET | /api/v1/groups | List Groups |
| POST | /api/v1/groups | Create Group |
| DELETE | /api/v1/groups/{group_id} | Delete Group |
| GET | /api/v1/groups/{group_id} | Get Group |
| PATCH | /api/v1/groups/{group_id} | Update Group |
| POST | /api/v1/groups/{group_id}/permissions | Assign Permission |
| DELETE | /api/v1/groups/{group_id}/permissions/{permission_id} | Remove Permission |
7 operations
apps
| Method | Path | Does |
|---|---|---|
| GET | /api/v1/apps | List Apps |
| POST | /api/v1/apps | Create App |
| DELETE | /api/v1/apps/{app_id} | Delete App |
| GET | /api/v1/apps/{app_id} | Get App |
| PATCH | /api/v1/apps/{app_id} | Update App |
5 operations
oauth
| Method | Path | Does |
|---|---|---|
| GET | /oauth/authorize | Authorization code grant |
| POST | /oauth/elevate | Atomic onboarding elevation |
| POST | /oauth/register | Dynamic Client Registration |
| POST | /oauth/revoke | Token revocation |
| POST | /oauth/token | Token exchange |
5 operations
keys
| Method | Path | Does |
|---|---|---|
| GET | /api/v1/keys | List My Keys |
| POST | /api/v1/keys | Create Key |
| GET | /api/v1/keys/all | List All Keys |
| DELETE | /api/v1/keys/{key_id} | Revoke Key |
4 operations
permissions
| Method | Path | Does |
|---|---|---|
| GET | /api/v1/permissions | List Permissions |
| POST | /api/v1/permissions | Create Permission |
| DELETE | /api/v1/permissions/{permission_id} | Delete Permission |
| GET | /api/v1/permissions/{permission_id} | Get Permission |
4 operations
.well-known
| Method | Path | Does |
|---|---|---|
| GET | /.well-known/oauth-authorization-server | Authorization Server Metadata (RFC 8414) |
| GET | /.well-known/oauth-protected-resource | Protected Resource Metadata (RFC 9728) |
2 operations
activity
| Method | Path | Does |
|---|---|---|
| GET | /api/v1/activity/logins | List Logins |
| GET | /api/v1/activity/sessions | Active Sessions |
2 operations
health
| Method | Path | Does |
|---|---|---|
| GET | /health | Basic health check |
| GET | /health/detailed | Detailed health check |
2 operations
magic-links
| Method | Path | Does |
|---|---|---|
| POST | /api/v1/magic-links | Issue Magic Link |
1 operation
prime
| Method | Path | Does |
|---|---|---|
| GET | /prime | Prime application caches |
1 operation
service-accounts
| Method | Path | Does |
|---|---|---|
| POST | /api/v1/service-accounts | Create a service account |
1 operation
status
| Method | Path | Does |
|---|---|---|
| GET | /status | Service status overview |
1 operation
All the partsRunning the shopThe platform's own id for this service is cbauth.
forge-catalog.json, generated Oct 30, 2026