auth

Authentication (register/login/logout/password-reset/me)

• POST/v1/auth/change_passwordChange the current user password (HIBP + Argon2id rehash)
• POST/v1/auth/forgot_passwordRequest a password-reset email (captcha-gated)
• POST/v1/auth/loginAuthenticate with email + password (+ optional TOTP)
• POST/v1/auth/logoutTerminate the active session
• GET/v1/auth/meFetch the authenticated user profile
• DELETE/v1/auth/mfa/{device_id}Remove an enrolled MFA device
• POST/v1/auth/mfa/enrollEnroll a TOTP device (returns provisioning URI)
• POST/v1/auth/mfa/verifyConfirm enrollment / login challenge with a TOTP code
• POST/v1/auth/password-resetRequest a password reset email (HMAC-signed token)
• POST/v1/auth/password-reset/confirmComplete password reset by submitting the token + new password
• POST/v1/auth/registerRegister a new user with email + password (Auth.js self-hosted)
• GET/v1/auth/sessionsList active sessions for the current user
• DELETE/v1/auth/sessions/{id}Revoke a specific session
• POST/v1/auth/sso/saml/acsSAML AssertionConsumerService — verifies + signs in
• POST/v1/auth/sso/saml/initiateBegin SAML SSO flow — returns IdP redirect URL
• POST/v1/auth/verify_emailConfirm an email-verification token