Me API

11 endpoints, generated from packages/core/openapi/v1.snapshot.json (OpenAPI 3.1.0, contract version 1.0). Conventions for lists, errors, money and authentication are on the API conventions page.

GET/api/v1/me

The signed-in member, their roles and effective permissions

Access

Any signed-in member (own data only)

Responses

200 Success. object

• userobjectrequired

  • idstring (uuid)required
  • emailstringrequired
  • displayNamestringrequired
  • preferredNamestring | nullrequired
  • fullNamestringrequired
• organisationobjectrequired

  • idstring (uuid)required
  • namestringrequired
  • slugstring | nullrequired
• membershipIdstring (uuid)required
• membershipStatusenumrequired

  one of "active", "former"

• employeeIdstring (uuid) or nullrequired
• rolesarray of enumrequired
• permissionsobjectrequired
• authMethodstringrequired
• sessionobjectrequired

  • kindenumrequired

    one of "browser", "device"

  • authenticatedAtstring (date-time)required
• mfaobjectrequired

  • enrolledbooleanrequired
  • requiredbooleanrequired
  • graceEndsAtstring (date-time) or nullrequired
  • blockedbooleanrequired
  • remainingRecoveryCodesintegerrequired

    min -9007199254740991

• hasPasswordbooleanrequired
• insecureTransportbooleanrequired
• demoModebooleanrequired
• mailerConfiguredbooleanrequired
• publicUrlstringrequired

• 401 session_expired, session_revoked, unauthenticated

GET/api/v1/me/identities

My linked sign-in identities

Access

Any signed-in member (own data only)

Responses

200 Success. object

• itemsarray of objectrequired

  • idstring (uuid)required
  • providerIdstring (uuid)required
  • providerNamestringrequired
  • kindstringrequired
  • linkedAtstring (date-time)required
  • lastUsedAtstring (date-time) or nullrequired

• 401 session_expired, session_revoked, unauthenticated
• 403 mfa_enrolment_required

DELETE/api/v1/me/identities/{id}

Unlink a sign-in identity

Refused when it is the only remaining way to sign in.

Access

Any signed-in member (own data only)

Re-authentication

Signed in within the last 10 minutes, otherwise 403 reauth_required

Parameters

Name	In	Type	Required
id	path	string (uuid)	yes

Responses

204 No content.

• 400 validation_failed
• 401 session_expired, session_revoked, unauthenticated
• 403 csrf_rejected, mfa_enrolment_required, reauth_required
• 404 not_found
• 409 conflict

DELETE/api/v1/me/mfa

Turn off two-step verification

Access

Any signed-in member (own data only)

Re-authentication

Signed in within the last 10 minutes, otherwise 403 reauth_required

Responses

204 No content.

• 401 session_expired, session_revoked, unauthenticated
• 403 csrf_rejected, mfa_enrolment_required, reauth_required

POST/api/v1/me/mfa/recovery-codes

Replace my recovery codes

Invalidates every previous recovery code.

Access

Any signed-in member (own data only)

Re-authentication

Signed in within the last 10 minutes, otherwise 403 reauth_required

Responses

200 Success. object

• recoveryCodesarray of stringrequired

• 401 session_expired, session_revoked, unauthenticated
• 403 csrf_rejected, mfa_enrolment_required, reauth_required
• 409 conflict

POST/api/v1/me/mfa/totp/confirm

Finish enrolment with a code from the authenticator app

Returns 10 single-use recovery codes, shown once.

Access

Any signed-in member (own data only)

Request body

application/json, object, required

• codestringrequired

Responses

200 Success. object

• recoveryCodesarray of stringrequired

• 400 validation_failed
• 401 invalid_mfa_code, session_expired, session_revoked, unauthenticated
• 403 csrf_rejected
• 409 conflict

POST/api/v1/me/mfa/totp/setup

Start authenticator-app enrolment

Returns a new secret and otpauth URI. Enrolment completes only after a valid code is confirmed.

Access

Any signed-in member (own data only)

Responses

200 Success. object

• secretstringrequired
• otpauthUristringrequired

• 401 session_expired, session_revoked, unauthenticated
• 403 csrf_rejected
• 409 conflict

POST/api/v1/me/password

Change my password

Access

Any signed-in member (own data only)

Re-authentication

Signed in within the last 10 minutes, otherwise 403 reauth_required

Request body

application/json, object, required

• currentPasswordstring

  max length 1024

• newPasswordstringrequired

  max length 1024

Responses

204 No content.

• 400 validation_failed
• 401 invalid_credentials, session_expired, session_revoked, unauthenticated
• 403 csrf_rejected, reauth_required

GET/api/v1/me/sessions

My browser and mobile sessions

Access

Any signed-in member (own data only)

Responses

200 Success. object

• itemsarray of objectrequired

  • idstringrequired
  • kindenumrequired

    one of "browser", "mobile"

  • devicestringrequired
  • ipstring | nullrequired
  • createdAtstring (date-time)required
  • lastActiveAtstring (date-time)required
  • currentbooleanrequired
  • authMethodstringrequired
  • appVersionstring | null

• 401 session_expired, session_revoked, unauthenticated
• 403 mfa_enrolment_required

DELETE/api/v1/me/sessions/{id}

Sign out one of my sessions

Access

Any signed-in member (own data only)

Parameters

Name	In	Type	Required
id	path	string	yes

Responses

204 No content.

• 400 validation_failed
• 401 session_expired, session_revoked, unauthenticated
• 403 csrf_rejected, mfa_enrolment_required
• 404 not_found

POST/api/v1/me/sessions/revoke-others

Sign out everywhere except here

Also unlinks every SSO sign-in method of this organisation including the one this session signed in with (`unlinked` counts them).

Access

Any signed-in member (own data only)

Responses

200 Success. object

• revokedintegerrequired

  min -9007199254740991

• unlinkedintegerrequired

  min -9007199254740991

• 401 session_expired, session_revoked, unauthenticated
• 403 csrf_rejected, mfa_enrolment_required