{ "openapi": "3.1.1", "info": { "title": "FlowPrime ALKEYON (auth)", "description": "Identity for FlowPrime: OIDC (authorization code + PKCE, refresh rotation), dynamic client registration, organizations, members, API keys and JWKS. Tenant is resolved from the {org} subdomain, a mapped custom domain, or the X-Org-Slug header.", "version": "8.1.1-af89431" }, "servers": [ { "url": "https://alkeyon.fastflow.tech", "description": "Platform host: discovery, the platform token endpoint, and /v1/orgs/*." }, { "url": "https://{org}.alkeyon.fastflow.tech", "description": "Tenant host. The org slug is also accepted as the X-Org-Slug header.", "variables": { "org": { "default": "your-org", "description": "Your FlowPrime organization slug" } } } ], "paths": { "/v1/auth/register": { "post": { "tags": [ "Alkeyon" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegisterRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/auth/login": { "post": { "tags": [ "Alkeyon" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LoginRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/auth/logout": { "post": { "tags": [ "Alkeyon" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LogoutRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/auth/verify-email/resend": { "post": { "tags": [ "Alkeyon" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResendVerificationRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/auth/forgot-password": { "post": { "tags": [ "Alkeyon" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ForgotPasswordRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/auth/reset-password": { "post": { "tags": [ "Alkeyon" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResetPasswordRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/auth/mfa/verify": { "post": { "tags": [ "Alkeyon" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MfaVerifyRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/auth/refresh": { "post": { "tags": [ "Alkeyon" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RefreshRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/auth/switch-account": { "post": { "tags": [ "Alkeyon" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SwitchAccountRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/auth/token": { "post": { "tags": [ "Alkeyon" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientTokenRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/auth/introspect": { "post": { "tags": [ "Alkeyon" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IntrospectRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/auth/exchange": { "post": { "tags": [ "Alkeyon" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExchangeCodeRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/auth/change-password": { "post": { "tags": [ "Alkeyon" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ChangePasswordRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/auth/me": { "get": { "tags": [ "Alkeyon" ], "responses": { "200": { "description": "OK" } } } }, "/v1/auth/my-accounts": { "get": { "tags": [ "Alkeyon" ], "responses": { "200": { "description": "OK" } } } }, "/v1/auth/profile": { "put": { "tags": [ "Alkeyon" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateProfileRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/auth/api-keys": { "post": { "tags": [ "Alkeyon" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateApiKeyRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } }, "get": { "tags": [ "Alkeyon" ], "responses": { "200": { "description": "OK" } } } }, "/v1/auth/api-keys/{id}": { "delete": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } } }, "/v1/auth/validate-key": { "post": { "tags": [ "Alkeyon" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ValidateKeyRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/auth/impersonate": { "post": { "tags": [ "Alkeyon" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ImpersonateRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/auth/impersonate/exit": { "post": { "tags": [ "Alkeyon" ], "responses": { "200": { "description": "OK" } } } }, "/v1/auth/impersonate/orgs": { "get": { "tags": [ "Alkeyon" ], "responses": { "200": { "description": "OK" } } } }, "/v1/admin/users": { "get": { "tags": [ "Alkeyon" ], "responses": { "200": { "description": "OK" } }, "security": [ { "adminKey": [ ] } ] } }, "/v1/admin/orgs": { "get": { "tags": [ "Alkeyon" ], "responses": { "200": { "description": "OK" } }, "security": [ { "adminKey": [ ] } ] } }, "/v1/admin/databases": { "get": { "tags": [ "Alkeyon" ], "responses": { "200": { "description": "OK" } }, "security": [ { "adminKey": [ ] } ] } }, "/v1/admin/orgs/{slug}/registration": { "get": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } }, "security": [ { "adminKey": [ ] } ] }, "put": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateRegistrationRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } }, "security": [ { "adminKey": [ ] } ] } }, "/v1/admin/orgs/{slug}/customer-accounts": { "get": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } }, "security": [ { "adminKey": [ ] } ] }, "put": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateCustomerAccountsRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } }, "security": [ { "adminKey": [ ] } ] } }, "/v1/admin/orgs/{slug}/apps/{clientId}/projection": { "get": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "clientId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } }, "security": [ { "adminKey": [ ] } ] }, "put": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "clientId", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProvisionOptions" } } }, "required": true }, "responses": { "200": { "description": "OK" } }, "security": [ { "adminKey": [ ] } ] } }, "/v1/admin/orgs/{slug}/apps/{clientId}": { "delete": { "tags": [ "Alkeyon" ], "summary": "Delete a dynamically registered OIDC client", "description": "Removes the client row from the organization, keyed by CLIENT id (ffa_...) rather than application id. The authorization codes and consents that belonged to it cascade, and the sessions minted through it are removed too - they carry the client id as a plain column with no foreign key, so leaving them would let a refresh keep working against a client that is gone. The answer carries how many went.\n\nThis is not the same act as DELETE /v1/orgs/{slug}/apps/{appId}, which REVOKES: that one sets isActive=false and keeps the row, so it stops the credentials and leaves the organization's application list exactly as long. Use revoke for a client whose id something else still holds, and this for one that only accumulates.\n\nTwo refusals, so the route can be pointed at a list without guessing which rows are safe. 409 client_not_dcr for anything not registered through /v1/connect/register: a hand-provisioned client's id is written into a deployment somewhere, and that one is revoked, never deleted. 409 client_in_use when a session minted through the client has not expired, because deleting it signs that connection out; ?force=true overrides that one and never the first. The answer names how many sessions are live.\n\n404 when the organization or the client is unknown, so deleting twice is safe and a cleanup path can call it unconditionally.\n\nAuthenticated with the platform provision key (X-Api-Key), like the rest of /v1/admin.", "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "clientId", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "force", "in": "query", "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DeleteAppResponse" } } } }, "404": { "description": "Not Found" }, "409": { "description": "Conflict" } }, "security": [ { "adminKey": [ ] } ] } }, "/v1/admin/orgs/{slug}": { "put": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RenameOrgRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } }, "security": [ { "adminKey": [ ] } ] }, "delete": { "tags": [ "Alkeyon" ], "summary": "Delete an organization and its silo", "description": "Destructive and not reversible. Removes the organization from the platform registry, with the directory links and pending local-user cleanups that point at it, and deletes the org's silo directory from disk - its SQLite database, keys and data-protection keys. Everyone who could only sign in through this organization loses that account.\n\nIt removes NOTHING OUTSIDE ALKEYON. Every other platform service keeps its own tenant row and per-org database for this slug, and each one has to be asked separately (DELETE /v1/tenants/{slug} on the service). Deleting the organization here does not cascade, on purpose: ALKEYON has no authority over another service's data, and a silent fan-out would make one call destroy state its caller never named.\n\nIdempotent, so a cleanup path can call it unconditionally: a slug with no registry row answers 200 with removed=false and reason=\"not found\", never an error. That call is not a no-op - it still deletes any silo directory left under the slug, because a directory with no registry row is read as a lost organization and re-seeded back into a live one by the maintenance sweep. On success the answer carries removed=true and the orgId that was deleted.\n\nThe slug is then RETIRED: a tombstone row keeps slug-available answering taken and provision answering 409 slug_retired, because the other services still hold the old org's tenants under it. The optional reason query value is stored on the tombstone. Free the slug on purpose with DELETE /v1/admin/tombstones/{slug} once every service has deleted its tenant.\n\nAuthenticated with the platform provision key (X-Api-Key) and nothing else, rather than a signed-in administrator: the callers are provisioning and test-cleanup code that hold no session. A bearer token gets 403, an organization's own provision client (ffa_provision_{slug}) included.", "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "reason", "in": "query", "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WipeOrgResponse" } } } } }, "security": [ { "provisionKey": [ ] } ] } }, "/v1/admin/orgs/{slug}/branding": { "put": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateBrandingRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } }, "security": [ { "adminKey": [ ] } ] } }, "/v1/admin/orgs/{slug}/provision-client": { "get": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } }, "security": [ { "adminKey": [ ] } ] }, "post": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } }, "security": [ { "adminKey": [ ] } ] } }, "/v1/admin/orgs/{slug}/home-url": { "get": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } }, "security": [ { "adminKey": [ ] } ] }, "put": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateHomeUrlRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } }, "security": [ { "adminKey": [ ] } ] } }, "/v1/admin/users/{userId}/roles": { "post": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "userId", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AssignRoleRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } }, "security": [ { "adminKey": [ ] } ] } }, "/v1/admin/users/{userId}/roles/{orgId}": { "delete": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "userId", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "orgId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } }, "security": [ { "adminKey": [ ] } ] } }, "/v1/admin/credentials/retire-silo": { "get": { "tags": [ "Alkeyon" ], "responses": { "200": { "description": "OK" } }, "security": [ { "adminKey": [ ] } ] }, "post": { "tags": [ "Alkeyon" ], "requestBody": { "content": { "application/json": { "schema": { "oneOf": [ { "type": "null" }, { "$ref": "#/components/schemas/RetireSiloRequest" } ] } } } }, "responses": { "200": { "description": "OK" } }, "security": [ { "adminKey": [ ] } ] } }, "/v1/admin/users/{id}/reset-mfa": { "post": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } }, "security": [ { "adminKey": [ ] } ] } }, "/v1/admin/invite": { "post": { "tags": [ "Alkeyon" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InviteRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } }, "security": [ { "adminKey": [ ] } ] } }, "/v1/admin/rotate-key": { "post": { "tags": [ "Alkeyon" ], "responses": { "200": { "description": "OK" } }, "security": [ { "adminKey": [ ] } ] } }, "/v1/admin/tombstones/{slug}": { "delete": { "tags": [ "Alkeyon" ], "summary": "Release a wiped organization's slug", "description": "Deletes the tombstone DELETE /v1/admin/orgs/{slug} left for the slug, so slug-available and provision treat it as free again. Call it only once every other service has deleted its own tenant for the slug (DELETE /v1/tenants/{slug} on each): otherwise the next organization provisioned under the slug is wired to the previous one's data.\n\nIdempotent: a slug with no tombstone answers 200 with released=false. Authenticated with the platform provision key (X-Api-Key) and nothing else.", "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ReleaseTombstoneResponse" } } } } }, "security": [ { "provisionKey": [ ] } ] } }, "/v1/admin/api-keys": { "post": { "tags": [ "Alkeyon" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdminCreateApiKeyRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/admin/api-keys/{userId}": { "get": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "userId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } } }, "/v1/admin/api-keys/{userId}/{keyId}": { "delete": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "userId", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "keyId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } } }, "/v1/auth/provision": { "post": { "tags": [ "Alkeyon" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProvisionRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } }, "security": [ { "provisionKey": [ ] } ] } }, "/v1/platform/test-issue-platform-token": { "post": { "tags": [ "Alkeyon" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TestIssuePlatformTokenRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/.well-known/jwks.json": { "get": { "tags": [ "Alkeyon" ], "responses": { "200": { "description": "OK" } } } }, "/v1/provision": { "post": { "tags": [ "Alkeyon" ], "summary": "Provision a tenant from a Stripe checkout event", "description": "The body is a Stripe event object, not a FlowPrime schema, so this endpoint declares no request model on purpose: publishing one would describe Stripe's contract as ours and go stale the moment Stripe changes it. Only data.object.email is read, best-effort - a body without it still provisions.", "responses": { "200": { "description": "OK" } } } }, "/v1/tenant/{stripeCustomerId}/slug": { "put": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "stripeCustomerId", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SlugRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/tenants/lookup": { "get": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "stripe_cus", "in": "query", "schema": { "type": "string" } }, { "name": "org_slug", "in": "query", "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } } }, "/v1/tenants/map": { "post": { "tags": [ "Alkeyon" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MapRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/.well-known/openid-configuration": { "get": { "tags": [ "Alkeyon" ], "responses": { "200": { "description": "OK" } } } }, "/.well-known/oauth-authorization-server": { "get": { "tags": [ "Alkeyon" ], "responses": { "200": { "description": "OK" } } } }, "/auth/external/{provider}": { "get": { "tags": [ "ExternalAuthEndpoints" ], "parameters": [ { "name": "provider", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "returnUrl", "in": "query", "schema": { "type": "string" } }, { "name": "link", "in": "query", "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "OK" } } } }, "/auth/callback/{provider}": { "get": { "tags": [ "ExternalAuthEndpoints" ], "parameters": [ { "name": "provider", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "code", "in": "query", "schema": { "type": "string" } }, { "name": "state", "in": "query", "schema": { "type": "string" } }, { "name": "error", "in": "query", "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } } }, "/v1/domains/resolve": { "get": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "hostname", "in": "query", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } } }, "/health": { "get": { "tags": [ "Alkeyon" ], "responses": { "200": { "description": "OK" } } } }, "/version.json": { "get": { "tags": [ "Alkeyon" ], "responses": { "200": { "description": "OK" } } } }, "/v1/orgs": { "post": { "tags": [ "Alkeyon" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateOrgRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } }, "get": { "tags": [ "Alkeyon" ], "responses": { "200": { "description": "OK" } } } }, "/v1/orgs/{slug}": { "get": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } } }, "/v1/orgs/{slug}/members": { "post": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AddMemberRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } }, "get": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } } }, "/v1/orgs/{slug}/members/{userIdOrEmail}": { "get": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "userIdOrEmail", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } } }, "/v1/orgs/{slug}/audit": { "get": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "since", "in": "query", "schema": { "type": "string" } }, { "name": "until", "in": "query", "schema": { "type": "string" } }, { "name": "type", "in": "query", "schema": { "type": "string" } }, { "name": "limit", "in": "query", "schema": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" } } ], "responses": { "200": { "description": "OK" } } } }, "/v1/orgs/{slug}/branding": { "get": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } }, "put": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateBrandingRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/orgs/{slug}/registration": { "get": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } }, "put": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateRegistrationRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/orgs/{slug}/free-email-domains": { "get": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } }, "put": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateFreeEmailDomainsRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/orgs/{slug}/home-url": { "get": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } }, "put": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateHomeUrlRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/orgs/{slug}/customers": { "get": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "page", "in": "query", "schema": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32", "default": 1 } }, { "name": "pageSize", "in": "query", "schema": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32", "default": 50 } } ], "responses": { "200": { "description": "OK" } } } }, "/v1/orgs/{slug}/accounts": { "get": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "page", "in": "query", "schema": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32", "default": 1 } }, { "name": "pageSize", "in": "query", "schema": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32", "default": 50 } } ], "responses": { "200": { "description": "OK" } } } }, "/v1/orgs/{slug}/members/{userId}": { "delete": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "userId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } } }, "/v1/orgs/{slug}/members/{userId}/role": { "put": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "userId", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateMemberRoleRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } }, "delete": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "userId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } } }, "/v1/orgs/{slug}/invites": { "post": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OrgInviteRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/orgs/{slug}/members/{userId}/reset-mfa": { "post": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "userId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } } }, "/v1/orgs/{slug}/apps": { "post": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateAppRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } }, "get": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } } }, "/v1/orgs/{slug}/apps/provision": { "post": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateAppRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } }, "security": [ { "provisionKey": [ ] } ] } }, "/v1/orgs/{slug}/apps/{appId}": { "get": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "appId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } }, "patch": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "appId", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateAppRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } }, "put": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "appId", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateAppRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } }, "delete": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "appId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } } }, "/v1/orgs/{slug}/apps/{appId}/rotate": { "post": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "appId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } } }, "/v1/orgs/{slug}/accounts/mine": { "get": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } } }, "/v1/orgs/{slug}/accounts/mine/invites": { "post": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InviteRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/orgs/{slug}/accounts/mine/invites/{invitationId}": { "delete": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "invitationId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } } }, "/v1/orgs/{slug}/accounts/mine/members/{userId}": { "delete": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "userId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } } }, "/v1/orgs/{slug}/accounts/mine/leave": { "post": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } } }, "/v1/orgs/{slug}/accounts/invitations/accept": { "post": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AcceptRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/orgs/{slug}/accounts/grants": { "post": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GrantRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } }, "security": [ { "adminKey": [ ] } ] } }, "/v1/orgs/{slug}/accounts/grants/{subscriptionId}": { "delete": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "subscriptionId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } }, "security": [ { "adminKey": [ ] } ] } }, "/v1/platform/token": { "post": { "tags": [ "Alkeyon" ], "summary": "Platform OIDC token endpoint (the master session)", "description": "Form-encoded, like /v1/connect/token, but for the ONE L0 platform client: authorization_code with PKCE S256 (single use) and refresh_token with one-time rotation. The body is read as a form rather than bound, so this declaration is the contract.", "requestBody": { "content": { "application/x-www-form-urlencoded": { "schema": { "type": "object", "properties": { "resource": { "type": [ "null", "string" ] }, "subject_token": { "type": [ "null", "string" ] }, "subject_token_type": { "type": [ "null", "string" ] }, "requested_token_type": { "type": [ "null", "string" ] }, "grant_type": { "type": "string" }, "client_id": { "type": [ "null", "string" ] }, "client_secret": { "type": [ "null", "string" ] }, "code": { "type": [ "null", "string" ] }, "redirect_uri": { "type": [ "null", "string" ] }, "code_verifier": { "type": [ "null", "string" ] }, "refresh_token": { "type": [ "null", "string" ] }, "scope": { "type": [ "null", "string" ] } } } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OidcTokenResponse" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OidcErrorResponse" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OidcErrorResponse" } } } } } } }, "/v1/platform/me": { "get": { "tags": [ "Alkeyon" ], "responses": { "200": { "description": "OK" } } } }, "/v1/platform/userinfo": { "get": { "tags": [ "Alkeyon" ], "summary": "Platform OIDC UserInfo endpoint (the master session)", "description": "The UserInfo endpoint the bare-host discovery document names. Bearer: a platform access token (aud alkeyon:platform). Answers the standard claims sub, email, email_verified, name and updated_at for the signed-in person; a silo token is refused.", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object" } } } }, "401": { "description": "Unauthorized" } } } }, "/v1/platform/my-workspaces": { "get": { "tags": [ "Alkeyon" ], "responses": { "200": { "description": "OK" } } } }, "/v1/platform/handoff": { "post": { "tags": [ "Alkeyon" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HandoffRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/platform/logout": { "post": { "tags": [ "Alkeyon" ], "responses": { "200": { "description": "OK" } } } }, "/v1/platform/sessions/revoke-all": { "post": { "tags": [ "Alkeyon" ], "responses": { "200": { "description": "OK" } } } }, "/v1/tenants/slug-available": { "get": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "query", "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } }, "security": [ { "provisionKey": [ ] } ] } }, "/v1/tenants/provision": { "post": { "tags": [ "Alkeyon" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProvisionRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } }, "security": [ { "provisionKey": [ ] } ] } }, "/v1/tenants/{orgId}/email": { "patch": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "orgId", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateEmailSettingsRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } }, "security": [ { "provisionKey": [ ] } ] } }, "/v1/tenants/deactivate": { "post": { "tags": [ "Alkeyon" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DeactivateTenantRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } }, "security": [ { "provisionKey": [ ] } ] } }, "/v1/tenants/activate": { "post": { "tags": [ "Alkeyon" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActivateTenantRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } }, "security": [ { "provisionKey": [ ] } ] } }, "/v1/connect/token": { "post": { "tags": [ "Alkeyon" ], "summary": "OAuth 2.0 / OIDC token endpoint", "description": "Form-encoded, per RFC 6749. Supported grants: authorization_code (PKCE S256 required for public clients, single use), refresh_token (one-time rotation - the old token is revoked as the new one is issued), and client_credentials. The body is read as a form rather than bound, so this declaration is the contract. Errors follow RFC 6749 section 5.2: a client that fails to authenticate (wrong or missing client_secret) is invalid_client with 401 on every grant, and invalid_grant with 400 is reserved for a code that is unknown, spent, expired or bound to another client or redirect_uri. Opt-in recipient grants require one exact configured HTTPS resource at authorization and code exchange; refresh may omit resource to inherit it and may only narrow scope. Wrong, duplicate or missing required resource returns invalid_target. The urn:ietf:params:oauth:grant-type:token-exchange grant accepts one subject_token of type urn:ietf:params:oauth:token-type:access_token, resource and optional scope, authenticated by an approved confidential backend. It issues an at+jwt downstream token for at most five minutes, never beyond the input expiry, with no refresh token. Actor tokens, audience substitution and chained exchange are refused. Unconfigured clients retain legacy behavior.", "requestBody": { "content": { "application/x-www-form-urlencoded": { "schema": { "type": "object", "properties": { "resource": { "type": [ "null", "string" ] }, "subject_token": { "type": [ "null", "string" ] }, "subject_token_type": { "type": [ "null", "string" ] }, "requested_token_type": { "type": [ "null", "string" ] }, "grant_type": { "type": "string" }, "client_id": { "type": [ "null", "string" ] }, "client_secret": { "type": [ "null", "string" ] }, "code": { "type": [ "null", "string" ] }, "redirect_uri": { "type": [ "null", "string" ] }, "code_verifier": { "type": [ "null", "string" ] }, "refresh_token": { "type": [ "null", "string" ] }, "scope": { "type": [ "null", "string" ] } } } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OidcTokenResponse" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OidcErrorResponse" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OidcErrorResponse" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OidcErrorResponse" } } } } } } }, "/v1/connect/userinfo": { "get": { "tags": [ "Alkeyon" ], "responses": { "200": { "description": "OK" } } } }, "/v1/connect/register": { "post": { "tags": [ "Alkeyon" ], "summary": "Dynamic client registration (RFC 7591)", "description": "Registers an OAuth client. redirect_uris is required. The target org comes from the request subdomain; on the bare host (the platform issuer) registration is refused with invalid_client_metadata naming the organization issuer to register on. Rate limited per IP.", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "client_name": { "type": [ "null", "string" ] }, "redirect_uris": { "type": [ "null", "array" ], "items": { "type": "string" } }, "grant_types": { "type": [ "null", "array" ], "items": { "type": "string" } }, "response_types": { "type": [ "null", "array" ], "items": { "type": "string" } }, "token_endpoint_auth_method": { "type": [ "null", "string" ] }, "scope": { "type": [ "null", "string" ] } } } } }, "required": true }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OidcErrorResponse" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OidcErrorResponse" } } } } } } }, "/v1/orgs/{slug}/domains": { "get": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } }, "post": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AddDomainRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/orgs/{slug}/domains/{id}": { "delete": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } } }, "/v1/orgs/{slug}/domains/{id}/refresh": { "post": { "tags": [ "Alkeyon" ], "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "AcceptRequest": { "required": [ "token" ], "type": "object", "properties": { "token": { "type": "string" } } }, "ActivateTenantRequest": { "required": [ "orgSlug" ], "type": "object", "properties": { "orgSlug": { "type": "string" }, "stripeCustomerId": { "type": [ "null", "string" ] }, "stripeSubscriptionId": { "type": [ "null", "string" ] }, "reason": { "type": [ "null", "string" ] } } }, "AddDomainRequest": { "required": [ "product", "hostname" ], "type": "object", "properties": { "product": { "type": "string" }, "hostname": { "type": "string" } } }, "AddMemberRequest": { "required": [ "email", "role" ], "type": "object", "properties": { "email": { "type": "string" }, "role": { "type": "string" } } }, "AdminCreateApiKeyRequest": { "required": [ "userId", "name", "orgId", "scopes", "expiresAt" ], "type": "object", "properties": { "userId": { "type": "string" }, "name": { "type": "string" }, "orgId": { "type": [ "null", "string" ] }, "scopes": { "type": [ "null", "string" ] }, "expiresAt": { "type": [ "null", "string" ], "format": "date-time" } } }, "AssignRoleRequest": { "required": [ "orgId", "role" ], "type": "object", "properties": { "orgId": { "type": "string" }, "role": { "type": "string" } } }, "ChangePasswordRequest": { "required": [ "currentPassword", "newPassword" ], "type": "object", "properties": { "currentPassword": { "type": "string" }, "newPassword": { "type": "string" } } }, "ClientTokenRequest": { "required": [ "grantType", "clientId", "clientSecret" ], "type": "object", "properties": { "grantType": { "type": "string" }, "clientId": { "type": "string" }, "clientSecret": { "type": "string" } } }, "CreateApiKeyRequest": { "required": [ "name", "orgId", "scopes", "expiresAt" ], "type": "object", "properties": { "name": { "type": "string" }, "orgId": { "type": [ "null", "string" ] }, "scopes": { "type": [ "null", "string" ] }, "expiresAt": { "type": [ "null", "string" ], "format": "date-time" } } }, "CreateAppRequest": { "required": [ "name", "scopes" ], "type": "object", "properties": { "name": { "type": "string" }, "scopes": { "type": [ "null", "string" ] }, "grantTypes": { "type": [ "null", "string" ] }, "redirectUris": { "type": [ "null", "array" ], "items": { "type": "string" } }, "isFirstParty": { "type": "boolean", "default": false }, "surface": { "type": [ "null", "string" ] }, "allowSelfRegistration": { "type": [ "null", "boolean" ] }, "checkoutUrl": { "type": [ "null", "string" ] }, "serviceUserId": { "type": [ "null", "string" ] }, "serviceAccountId": { "type": [ "null", "string" ] }, "consumerAccountId": { "type": [ "null", "string" ] }, "signupGrantsAccount": { "type": [ "null", "boolean" ] }, "freeTier": { "type": [ "null", "string" ] }, "refreshTokenExpiryDays": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "null", "integer", "string" ], "format": "int32" }, "requirePkce": { "type": [ "null", "boolean" ] }, "public": { "type": [ "null", "boolean" ] }, "signupProfile": { "oneOf": [ { "type": "null" }, { "$ref": "#/components/schemas/SignupProfile" } ] }, "options": { "$ref": "#/components/schemas/ProvisionOptions" } } }, "CreateOrgRequest": { "required": [ "name", "slug" ], "type": "object", "properties": { "name": { "type": "string" }, "slug": { "type": "string" } } }, "DeactivateTenantRequest": { "required": [ "orgSlug" ], "type": "object", "properties": { "orgSlug": { "type": "string" }, "subscriptionId": { "type": [ "null", "string" ] }, "productSlug": { "type": [ "null", "string" ] }, "reason": { "type": [ "null", "string" ] }, "cancelledAt": { "type": [ "null", "string" ], "format": "date-time" } } }, "DeleteAppResponse": { "required": [ "deleted", "slug", "clientId", "name", "sessionsRemoved" ], "type": "object", "properties": { "deleted": { "type": "boolean" }, "slug": { "type": "string" }, "clientId": { "type": "string" }, "name": { "type": [ "null", "string" ] }, "sessionsRemoved": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" } } }, "ExchangeCodeRequest": { "required": [ "code" ], "type": "object", "properties": { "code": { "type": "string" } } }, "ForgotPasswordRequest": { "required": [ "email" ], "type": "object", "properties": { "email": { "type": "string" } } }, "GrantRequest": { "required": [ "email", "subscriptionId" ], "type": "object", "properties": { "email": { "type": [ "null", "string" ] }, "subscriptionId": { "type": [ "null", "string" ] }, "slug": { "type": [ "null", "string" ] } } }, "HandoffRequest": { "required": [ "slug" ], "type": "object", "properties": { "slug": { "type": "string" }, "returnUrl": { "type": [ "null", "string" ] } } }, "ImpersonateRequest": { "required": [ "orgSlug" ], "type": "object", "properties": { "orgSlug": { "type": "string" } } }, "IntrospectRequest": { "required": [ "token" ], "type": "object", "properties": { "token": { "type": "string" } } }, "InviteRequest": { "required": [ "email", "orgId", "role", "displayName" ], "type": "object", "properties": { "email": { "type": "string" }, "orgId": { "type": "string" }, "role": { "type": "string" }, "displayName": { "type": [ "null", "string" ] } } }, "LoginRequest": { "required": [ "email", "password" ], "type": "object", "properties": { "email": { "type": "string" }, "password": { "type": "string" } } }, "LogoutRequest": { "required": [ "refreshToken" ], "type": "object", "properties": { "refreshToken": { "type": "string" } } }, "MapRequest": { "required": [ "stripeCus", "orgSlug", "orgName" ], "type": "object", "properties": { "stripeCus": { "type": "string" }, "orgSlug": { "type": "string" }, "orgName": { "type": "string" } } }, "MfaVerifyRequest": { "required": [ "challengeToken", "code" ], "type": "object", "properties": { "challengeToken": { "type": "string" }, "code": { "type": "string" } } }, "OidcErrorResponse": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": [ "null", "string" ] } } }, "OidcTokenResponse": { "type": "object", "properties": { "issued_token_type": { "type": [ "null", "string" ] }, "access_token": { "type": "string" }, "token_type": { "type": "string" }, "expires_in": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" }, "refresh_token": { "type": [ "null", "string" ] }, "id_token": { "type": [ "null", "string" ] }, "scope": { "type": [ "null", "string" ] } } }, "OrgInviteRequest": { "required": [ "email", "role", "displayName" ], "type": "object", "properties": { "email": { "type": "string" }, "role": { "type": "string" }, "displayName": { "type": [ "null", "string" ] } } }, "ProvisionOptions": { "type": "object", "properties": { "surface": { "type": [ "null", "string" ] }, "allowSelfRegistration": { "type": [ "null", "boolean" ] }, "checkoutUrl": { "type": [ "null", "string" ] }, "serviceUserId": { "type": [ "null", "string" ] }, "serviceAccountId": { "type": [ "null", "string" ] }, "consumerAccountId": { "type": [ "null", "string" ] }, "signupGrantsAccount": { "type": [ "null", "boolean" ] }, "freeTier": { "type": [ "null", "string" ] }, "refreshTokenExpiryDays": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "null", "integer", "string" ], "format": "int32" }, "isEmpty": { "type": "boolean" }, "refreshTokenExpiryDaysIsValid": { "type": "boolean" } } }, "ProvisionRequest": { "required": [ "email", "orgId", "role", "displayName" ], "type": "object", "properties": { "email": { "type": "string" }, "orgId": { "type": "string" }, "role": { "type": "string" }, "displayName": { "type": [ "null", "string" ] } } }, "RefreshRequest": { "required": [ "refreshToken" ], "type": "object", "properties": { "refreshToken": { "type": "string" } } }, "RegisterRequest": { "required": [ "email", "password", "displayName" ], "type": "object", "properties": { "email": { "type": "string" }, "password": { "type": "string" }, "displayName": { "type": [ "null", "string" ] }, "attributes": { "type": [ "null", "object" ], "additionalProperties": { "type": "string" } }, "clientId": { "type": [ "null", "string" ] } } }, "ReleaseTombstoneResponse": { "required": [ "released", "slug" ], "type": "object", "properties": { "released": { "type": "boolean" }, "slug": { "type": "string" }, "orgId": { "type": [ "null", "string" ] } } }, "RenameOrgRequest": { "required": [ "name" ], "type": "object", "properties": { "name": { "type": [ "null", "string" ] } } }, "ResendVerificationRequest": { "required": [ "email" ], "type": "object", "properties": { "email": { "type": "string" } } }, "ResetPasswordRequest": { "required": [ "token", "newPassword" ], "type": "object", "properties": { "token": { "type": "string" }, "newPassword": { "type": "string" } } }, "RetireSiloRequest": { "type": "object", "properties": { "snapshotConfirmed": { "type": "boolean", "default": false }, "force": { "type": "boolean", "default": false } } }, "SignupAttributeSpec": { "required": [ "key", "label" ], "type": "object", "properties": { "key": { "type": "string" }, "label": { "type": "string" }, "required": { "type": "boolean", "default": true }, "pattern": { "type": [ "null", "string" ] }, "placeholder": { "type": [ "null", "string" ] }, "validator": { "type": [ "null", "string" ] }, "hint": { "type": [ "null", "string" ] } } }, "SignupProfile": { "required": [ "fields" ], "type": "object", "properties": { "fields": { "type": "array", "items": { "$ref": "#/components/schemas/SignupAttributeSpec" } }, "splitName": { "type": "boolean", "default": false }, "workEmailOnly": { "type": "boolean", "default": false } } }, "SlugRequest": { "required": [ "org_slug" ], "type": "object", "properties": { "org_slug": { "type": "string" } } }, "SwitchAccountRequest": { "required": [ "refreshToken", "accountId", "clientId" ], "type": "object", "properties": { "refreshToken": { "type": "string" }, "accountId": { "type": "string" }, "clientId": { "type": "string" } } }, "TestIssuePlatformTokenRequest": { "required": [ "email" ], "type": "object", "properties": { "email": { "type": "string" } } }, "UpdateAppRequest": { "type": "object", "properties": { "name": { "type": [ "null", "string" ] }, "redirectUris": { "type": [ "null", "array" ], "items": { "type": "string" } }, "grantTypes": { "type": [ "null", "array" ], "items": { "type": "string" } }, "scopes": { "type": [ "null", "string" ] }, "requirePkce": { "type": [ "null", "boolean" ] }, "signupProfile": { "oneOf": [ { "type": "null" }, { "$ref": "#/components/schemas/SignupProfile" } ] } } }, "UpdateBrandingRequest": { "type": "object", "properties": { "productName": { "type": [ "null", "string" ] }, "primaryColor": { "type": [ "null", "string" ] }, "locale": { "type": [ "null", "string" ] }, "logoUrl": { "type": [ "null", "string" ] }, "logoDarkUrl": { "type": [ "null", "string" ] }, "faviconUrl": { "type": [ "null", "string" ] }, "companyName": { "type": [ "null", "string" ] }, "tagline": { "type": [ "null", "string" ] }, "accentColor": { "type": [ "null", "string" ] }, "backgroundColor": { "type": [ "null", "string" ] }, "surfaceColor": { "type": [ "null", "string" ] }, "textColor": { "type": [ "null", "string" ] }, "textMutedColor": { "type": [ "null", "string" ] }, "borderColor": { "type": [ "null", "string" ] }, "fontFamily": { "type": [ "null", "string" ] }, "fontUrl": { "type": [ "null", "string" ] }, "supportEmail": { "type": [ "null", "string" ] }, "privacyUrl": { "type": [ "null", "string" ] }, "termsUrl": { "type": [ "null", "string" ] }, "footerText": { "type": [ "null", "string" ] }, "lifecycleSender": { "type": [ "null", "string" ] } } }, "UpdateCustomerAccountsRequest": { "required": [ "enableCustomerAccounts" ], "type": "object", "properties": { "enableCustomerAccounts": { "type": "boolean" } } }, "UpdateEmailSettingsRequest": { "required": [ "ffMailBaseUrl", "ffMailServerToken" ], "type": "object", "properties": { "ffMailBaseUrl": { "type": [ "null", "string" ] }, "ffMailServerToken": { "type": [ "null", "string" ] } } }, "UpdateFreeEmailDomainsRequest": { "required": [ "domains" ], "type": "object", "properties": { "domains": { "type": [ "null", "array" ], "items": { "type": "string" } } } }, "UpdateHomeUrlRequest": { "required": [ "homeUrl" ], "type": "object", "properties": { "homeUrl": { "type": [ "null", "string" ] } } }, "UpdateMemberRoleRequest": { "required": [ "role" ], "type": "object", "properties": { "role": { "type": "string" } } }, "UpdateProfileRequest": { "required": [ "displayName" ], "type": "object", "properties": { "displayName": { "type": "string" } } }, "UpdateRegistrationRequest": { "required": [ "allowRegistration" ], "type": "object", "properties": { "allowRegistration": { "type": "boolean" } } }, "ValidateKeyRequest": { "required": [ "apiKey" ], "type": "object", "properties": { "apiKey": { "type": "string" }, "scope": { "type": [ "null", "string" ] } } }, "WipeOrgResponse": { "required": [ "removed", "slug" ], "type": "object", "properties": { "removed": { "type": "boolean" }, "slug": { "type": "string" }, "orgId": { "type": [ "null", "string" ] }, "reason": { "type": [ "null", "string" ] } } } }, "securitySchemes": { "provisionKey": { "type": "apiKey", "description": "The platform provision key: the shared credential every FlowPrime service validates on its own /v1/tenants/* routes. Held by the provisioning orchestrator and by cleanup code, never by a browser.", "name": "X-Api-Key", "in": "header" }, "adminKey": { "type": "apiKey", "description": "The ALKEYON platform-admin key. Opens the cross-org /v1/admin reads and writes.", "name": "X-Api-Key", "in": "header" } } }, "tags": [ { "name": "Alkeyon" }, { "name": "ExternalAuthEndpoints" } ] }