API reference
Auth service
Sign-up, login, tokens, OAuth, users, roles, and permissions (Heimdal).
Heimdal issues and verifies every token the other surfaces accept: console user tokens, consumer (website visitor) tokens, and MCP access tokens via OAuth. It also holds users, roles, and permissions. Operations tagged internal are service-to-service.
45 endpoints in 9 groups.
Auth
- POST
/api/v1/auth/forgot-passwordForgot Password - POST
/api/v1/auth/loginLogin - POST
/api/v1/auth/logoutLogout - POST
/api/v1/auth/refreshRefresh Token - POST
/api/v1/auth/resend-verificationResend Verification - POST
/api/v1/auth/reset-passwordReset Password - POST
/api/v1/auth/signupCreate User - POST
/api/v1/auth/socialSocial Login - GET
/api/v1/auth/verify-emailVerify Email Token - POST
/api/v1/auth/verify-emailVerify Email Otp
Consumer
Internal
- POST
/api/v1/internal/account-invites/send-emailSend Account Invite Email - POST
/api/v1/internal/billing-notifications/send-emailSend Billing Notification Email - POST
/api/v1/internal/escalation-notifications/send-emailSend Escalation Notification Email - POST
/api/v1/internal/lead-notifications/send-emailSend Lead Notification Email - POST
/api/v1/internal/review-notifications/send-emailSend Review Notification Email - GET
/api/v1/internal/usersList Users - PATCH
/api/v1/internal/users/{user_id}Update User - POST
/api/v1/internal/users/lookupLookup Users - POST
/api/v1/internal/users/provisionProvision User
OAuth
Permissions
Roles
- GET
/api/v1/roles/List Roles - POST
/api/v1/roles/Create Role - GET
/api/v1/roles/{role_id}Get Role - PUT
/api/v1/roles/{role_id}Update Role - DELETE
/api/v1/roles/{role_id}Delete Role - POST
/api/v1/roles/{role_id}/permissionsAssign Permissions To Role - DELETE
/api/v1/roles/{role_id}/permissions/{permission_id}Remove Permission From Role