Auth API reference
Every route served by auth.thundera.eu, generated from the router source so it cannot drift. For flows and payloads see Account & single sign-on and Plans & billing.
Conventions
- Base URL
https://auth.thundera.eu. JSON in, JSON out; errors are { "error": "message", "code": "MACHINE_CODE" } with the matching HTTP status.
- session / bearer — the
thundera_token cookie (browsers) or Authorization: Bearer <access token> (native clients). system role — additionally one of system-super-admin, system-admin, system-support (support is read-only). org admin / member — membership of the organization in the path.
- Mutating requests from a browser must come from a
*.thundera.eu origin (CORS allow-list); credentials are sent with credentials: "include".
/api/* is rate limited per IP; login and password flows have additional brute-force lockouts.- Platform routes under
/api/v1/system/* are for operators and are listed for completeness.
Account, sessions and devices
| Method |
Path |
Auth |
Notes |
POST |
/api/v1/auth/change-email |
session / bearer |
|
POST |
/api/v1/auth/confirm-email |
session / bearer |
|
GET |
/api/v1/auth/devices |
session / bearer |
Active sessions of the user; the caller is flagged current. |
DELETE |
/api/v1/auth/devices/:id |
session / bearer |
|
POST |
/api/v1/auth/devices/:id/trust |
session / bearer |
|
POST |
/api/v1/auth/devices/:id/untrust |
session / bearer |
|
POST |
/api/v1/auth/devices/revoke-others |
session / bearer |
Revoke every session except the current one. |
POST |
/api/v1/auth/forgot-password |
public |
Always 200; sends a reset link when the email exists. |
POST |
/api/v1/auth/login |
public |
Body { email, password, trustDevice }. Sets thundera_token + thundera_refresh cookies; returns accessToken, refreshToken, sessionId. |
POST |
/api/v1/auth/logout |
session / bearer |
Revokes the current session only. |
POST |
/api/v1/auth/logout-everywhere |
session / bearer |
Bumps session_generation: every access token is rejected immediately. |
GET |
/api/v1/auth/me |
optional session |
Current user (profile, roles, plan, org). With ?optional=1 anonymous callers get 200 {user:null}. |
PUT |
/api/v1/auth/me |
session / bearer |
Update display name, phone, recovery email, avatar preference. |
GET |
/api/v1/auth/mfa-cancel |
public |
|
POST |
/api/v1/auth/mfa-removal-request |
public |
|
POST |
/api/v1/auth/mfa-removal-verify |
public |
|
POST |
/api/v1/auth/native-exchange |
public |
Exchange a one-time native code + PKCE verifier for tokens (60 s, single use). |
GET |
/api/v1/auth/native-redirect |
public |
Desktop/mobile sign-in confirmation page (allow-listed callback, PKCE S256). |
POST |
/api/v1/auth/native-redirect |
public |
|
GET |
/api/v1/auth/native-tokens |
public |
|
POST |
/api/v1/auth/native-tokens |
session / bearer |
|
PUT |
/api/v1/auth/password |
session / bearer |
Body { currentPassword, newPassword }. |
POST |
/api/v1/auth/refresh |
public |
Body { refreshToken }. Rotates the refresh token on the same session row; 401 only when the session is revoked. |
POST |
/api/v1/auth/register |
public |
Create an account; Turnstile-protected; sends the verification email. |
POST |
/api/v1/auth/reset-password |
public |
Body { token, password }. Revokes all sessions. |
GET |
/api/v1/auth/session |
public |
Browser SPA refresh: renews the access cookie from the refresh cookie and returns the user. |
GET |
/api/v1/auth/turnstile/config |
public |
|
GET |
/api/v1/auth/verify |
session / bearer |
|
Social sign-in
| Method |
Path |
Auth |
Notes |
GET |
/api/v1/auth/social/callback/:provider |
public |
|
GET |
/api/v1/auth/social/login/:provider |
public |
|
GET |
/api/v1/auth/social/providers |
public |
|
Sign in with Apple
| Method |
Path |
Auth |
Notes |
POST |
/api/v1/auth/apple |
public |
|
Apps catalogue
| Method |
Path |
Auth |
Notes |
GET |
/api/v1/auth/apps |
session / bearer |
Apps the signed-in user can open (drives the Shell apps menu). |
GET |
/api/v1/auth/apps/announcements |
public |
|
GET |
/api/v1/auth/apps/public |
public |
Public catalogue of listed apps. |
GET |
/api/v1/auth/apps/status/:slug |
public |
|
Plans, subscriptions and payment methods
| Method |
Path |
Auth |
Notes |
GET |
/api/v1/auth/billing |
session / bearer |
Subscriptions of the user. |
POST |
/api/v1/auth/billing/cancel |
session / bearer |
|
POST |
/api/v1/auth/billing/confirm-payment-method |
session / bearer |
|
GET |
/api/v1/auth/billing/effective-plan/:app |
session / bearer |
Resolved tier and limits (including ai_monthly_usd) for the caller in one app. |
GET |
/api/v1/auth/billing/invoices |
session / bearer |
|
DELETE |
/api/v1/auth/billing/items/:app_slug |
session / bearer |
|
GET |
/api/v1/auth/billing/payment-methods |
session / bearer |
|
DELETE |
/api/v1/auth/billing/payment-methods/:id |
session / bearer |
|
GET |
/api/v1/auth/billing/plans |
public |
Plan catalogue, single source of truth. ?app=. USD cents, cached 60 s, CORS for *.thundera.eu. |
GET |
/api/v1/auth/billing/plans/:id/limits |
public |
|
GET |
/api/v1/auth/billing/plans/by-tier/:app/:tier |
public |
|
POST |
/api/v1/auth/billing/refresh |
session / bearer |
|
POST |
/api/v1/auth/billing/resume |
session / bearer |
|
POST |
/api/v1/auth/billing/setup-intent |
session / bearer |
|
POST |
/api/v1/auth/billing/subscribe |
session / bearer |
Start or change a subscription. |
GET |
/api/v1/auth/billing/summary |
session / bearer |
|
POST |
/api/v1/auth/billing/webhook |
public |
Stripe webhook (signature verified, idempotent). |
| Method |
Path |
Auth |
Notes |
POST |
/api/v1/auth/promo/redeem |
session / bearer |
|
GET |
/api/v1/auth/promo/validate |
public |
|
Regions
| Method |
Path |
Auth |
Notes |
GET |
/api/v1/auth/regions |
public |
|
GET |
/api/v1/auth/regions/me |
session / bearer |
|
PUT |
/api/v1/auth/regions/me |
session / bearer |
|
Downloads
| Method |
Path |
Auth |
Notes |
GET |
/api/v1/auth/downloads/:product/:os/:arch |
public |
|
POST |
/api/v1/auth/downloads/:product/:os/:arch?/track |
session / bearer |
|
GET |
/api/v1/auth/downloads/:product/:os/latest |
public |
|
GET |
/api/v1/auth/downloads/index |
public |
|
Feedback and issues
| Method |
Path |
Auth |
Notes |
POST |
/api/v1/auth/feedback |
session / bearer |
|
Site subscriptions
| Method |
Path |
Auth |
Notes |
POST |
/api/v1/site-subscriptions |
public |
|
GET |
/api/v1/site-subscriptions/config |
public |
|
GET |
/api/v1/site-subscriptions/opt-out/:token |
public |
|
Public status
| Method |
Path |
Auth |
Notes |
GET |
/api/v1/status/events |
public |
Public 90-day incident feed. |
GET |
/api/v1/status/summary |
public |
Public 7-day status grid. |
Organizations (client admin)
| Method |
Path |
Auth |
Notes |
GET |
/api/v1/admin/orgs |
public |
Organizations the caller belongs to. |
POST |
/api/v1/admin/orgs |
public |
Create an organization. |
GET |
/api/v1/admin/orgs/:orgId |
org member |
|
PUT |
/api/v1/admin/orgs/:orgId |
org admin |
|
GET |
/api/v1/admin/orgs/:orgId/apps |
org member |
|
PUT |
/api/v1/admin/orgs/:orgId/apps |
org admin |
|
PUT |
/api/v1/admin/orgs/:orgId/domain |
org admin |
|
GET |
/api/v1/admin/orgs/:orgId/domains |
org member |
|
POST |
/api/v1/admin/orgs/:orgId/domains |
org admin |
|
DELETE |
/api/v1/admin/orgs/:orgId/domains/:domainId |
org admin |
|
GET |
/api/v1/admin/orgs/:orgId/members |
org member |
|
POST |
/api/v1/admin/orgs/:orgId/members |
org admin |
|
DELETE |
/api/v1/admin/orgs/:orgId/members/:userId |
org admin |
|
PATCH |
/api/v1/admin/orgs/:orgId/members/:userId |
org admin |
|
GET |
/api/v1/admin/orgs/:orgId/plan-billing |
org admin |
|
GET |
/api/v1/admin/orgs/:orgId/sso |
org admin |
|
POST |
/api/v1/admin/orgs/:orgId/sso |
org admin |
|
DELETE |
/api/v1/admin/orgs/:orgId/sso/:connectorId |
org admin |
|
PATCH |
/api/v1/admin/orgs/:orgId/sso/:connectorId |
org admin |
|
GET |
/api/v1/admin/plans |
public |
|
OIDC / OAuth 2.1 authorization server
| Method |
Path |
Auth |
Notes |
GET |
/.well-known/jwks.json |
public |
|
GET |
/.well-known/oauth-authorization-server |
public |
|
GET |
/.well-known/openid-configuration |
public |
|
GET |
/api/v1/oidc/authorize |
public |
|
POST |
/api/v1/oidc/authorize |
public |
|
GET |
/api/v1/oidc/entitlements/:app |
public |
|
POST |
/api/v1/oidc/register |
public |
|
POST |
/api/v1/oidc/revoke |
public |
|
POST |
/api/v1/oidc/token |
public |
|
GET |
/api/v1/oidc/userinfo |
public |
|
Activities log
| Method |
Path |
Auth |
Notes |
GET |
/api/v1/system/activities-log |
system role |
|
GET |
/api/v1/system/activities-log/apps |
system role |
|
Apps & announcements (system)
| Method |
Path |
Auth |
Notes |
GET |
/api/v1/system/apps |
public |
|
POST |
/api/v1/system/apps |
public |
|
PUT |
/api/v1/system/apps/:slug |
public |
|
POST |
/api/v1/system/apps/:slug/disable |
public |
|
POST |
/api/v1/system/apps/:slug/enable |
public |
|
POST |
/api/v1/system/apps/:slug/maintenance |
public |
|
POST |
/api/v1/system/apps/:slug/status |
public |
|
POST |
/api/v1/system/apps/announcements |
public |
|
DELETE |
/api/v1/system/apps/announcements/:id |
public |
|
PUT |
/api/v1/system/apps/announcements/:id |
public |
|
GET |
/api/v1/system/apps/announcements/all |
public |
|
Billing operations (system)
| Method |
Path |
Auth |
Notes |
GET |
/api/v1/system/billing/customers |
system role |
|
GET |
/api/v1/system/billing/customers/:id |
system role |
|
POST |
/api/v1/system/billing/customers/:id/cancel |
system role |
|
POST |
/api/v1/system/billing/customers/:id/cancel-item |
system role |
|
POST |
/api/v1/system/billing/customers/:id/change-plan |
system role |
|
POST |
/api/v1/system/billing/customers/:id/refund |
system role |
|
POST |
/api/v1/system/billing/customers/:id/resume |
system role |
|
POST |
/api/v1/system/billing/customers/:id/resync |
system role |
|
GET |
/api/v1/system/billing/events |
system role |
|
GET |
/api/v1/system/billing/invoices |
system role |
|
GET |
/api/v1/system/billing/kpis |
system role |
|
Feedback triage (system)
| Method |
Path |
Auth |
Notes |
GET |
/api/v1/system/feedback |
public |
|
GET |
/api/v1/system/feedback/:id |
public |
|
PATCH |
/api/v1/system/feedback/:id |
public |
|
GET |
/api/v1/system/feedback/:id/attachments/:attachmentId |
public |
|
GET |
/api/v1/system/issues |
public |
|
POST |
/api/v1/system/issues |
public |
|
GET |
/api/v1/system/issues/:id |
public |
|
PATCH |
/api/v1/system/issues/:id |
public |
|
GET |
/api/v1/system/issues/:id/attachments/:attachmentId |
public |
|
Monitoring (system)
| Method |
Path |
Auth |
Notes |
GET |
/api/v1/system/monitoring/overview |
system role |
|
POST |
/api/v1/system/monitoring/probe/:slug |
system role |
|
Plan catalogue admin (system)
| Method |
Path |
Auth |
Notes |
GET |
/api/v1/system/plans |
system role |
|
POST |
/api/v1/system/plans |
system role |
|
DELETE |
/api/v1/system/plans/:id |
system role |
|
PATCH |
/api/v1/system/plans/:id |
system role |
|
| Method |
Path |
Auth |
Notes |
GET |
/api/v1/system/promo |
public |
|
POST |
/api/v1/system/promo |
public |
|
DELETE |
/api/v1/system/promo/:id |
public |
|
PUT |
/api/v1/system/promo/:id |
public |
|
GET |
/api/v1/system/promo/:id/redemptions |
public |
|
Site subscriptions (system)
| Method |
Path |
Auth |
Notes |
GET |
/api/v1/system/site-subscriptions |
public |
|
POST |
/api/v1/system/site-subscriptions |
public |
|
DELETE |
/api/v1/system/site-subscriptions/:id |
public |
|
PATCH |
/api/v1/system/site-subscriptions/:id |
public |
|
POST |
/api/v1/system/site-subscriptions/:id/opt-out |
public |
|
POST |
/api/v1/system/site-subscriptions/:id/use |
public |
|
Status page admin (system)
| Method |
Path |
Auth |
Notes |
GET |
/api/v1/system/status/apps |
public |
|
GET |
/api/v1/system/status/incidents |
public |
|
POST |
/api/v1/system/status/incidents |
public |
|
DELETE |
/api/v1/system/status/incidents/:id |
public |
|
GET |
/api/v1/system/status/incidents/:id |
public |
|
PATCH |
/api/v1/system/status/incidents/:id |
public |
|
POST |
/api/v1/system/status/incidents/:id/updates |
public |
|
System administration
| Method |
Path |
Auth |
Notes |
GET |
/api/v1/system/audit |
system role |
|
GET |
/api/v1/system/bedrock |
system role |
|
POST |
/api/v1/system/bedrock/block |
public |
|
POST |
/api/v1/system/bedrock/unblock |
public |
|
GET |
/api/v1/system/orgs |
system role |
|
GET |
/api/v1/system/orgs/:orgId |
system role |
|
PUT |
/api/v1/system/orgs/:orgId |
public |
|
GET |
/api/v1/system/orgs/:orgId/apps |
system role |
|
PUT |
/api/v1/system/orgs/:orgId/apps |
public |
|
PUT |
/api/v1/system/orgs/:orgId/domain |
public |
|
GET |
/api/v1/system/orgs/:orgId/domains |
system role |
|
POST |
/api/v1/system/orgs/:orgId/domains |
public |
|
DELETE |
/api/v1/system/orgs/:orgId/domains/:domainId |
public |
|
POST |
/api/v1/system/orgs/:orgId/members |
public |
|
DELETE |
/api/v1/system/orgs/:orgId/members/:userId |
public |
|
PATCH |
/api/v1/system/orgs/:orgId/members/:userId |
public |
|
GET |
/api/v1/system/orgs/:orgId/sso |
system role |
|
POST |
/api/v1/system/orgs/:orgId/sso |
public |
|
DELETE |
/api/v1/system/orgs/:orgId/sso/:connectorId |
public |
|
PATCH |
/api/v1/system/orgs/:orgId/sso/:connectorId |
public |
|
GET |
/api/v1/system/settings/privacy |
public |
|
PUT |
/api/v1/system/settings/privacy |
public |
|
GET |
/api/v1/system/stats |
system role |
|
GET |
/api/v1/system/stats/insights |
system role |
|
GET |
/api/v1/system/users |
system role |
|
GET |
/api/v1/system/users/:userId |
system role |
|
PUT |
/api/v1/system/users/:userId |
public |
|
PUT |
/api/v1/system/users/:userId/app-roles |
public |
|
POST |
/api/v1/system/users/:userId/notes |
system role |
|
POST |
/api/v1/system/users/:userId/reset-password |
system role |
|
PUT |
/api/v1/system/users/:userId/roles |
public |
|
POST |
/api/v1/system/users/:userId/unblock |
public |
|