Skip to content

Native apps API

3 endpoints, generated from packages/core/openapi/v1.snapshot.json (OpenAPI 3.1.0, contract version 1.0). Conventions for lists, errors, money and authentication are on the API conventions page.

GET/api/v1/native/authorize

Start a native-app sign-in (system browser, PKCE S256)

Access
Public (no sign-in)

Parameters

NameInTypeRequired
orgquerystringyes
clientqueryenumyes
redirect_uriquerystringyes
code_challengequerystringyes
code_challenge_methodquery"S256"yes
statequerystringyes

Responses

302 Redirect to the organisation's sign-in page.

  • 400 validation_failed

POST/api/v1/native/revoke

Sign this device out

Access
Any signed-in member (own data only)

Responses

204 No content.

  • 401 session_expired, session_revoked, unauthenticated
  • 403 csrf_rejected

POST/api/v1/native/token

Exchange an authorisation code, or rotate a refresh token

Access
Public (no sign-in)

Request body

application/json, object | object, required

Responses

200 Success. object

  • accessTokenstringrequired
  • tokenType"Bearer"required
  • expiresInintegerrequired

    min -9007199254740991

  • refreshTokenstringrequired
  • deviceSessionIdstring (uuid)required
  • 400 invalid_grant, validation_failed
  • 403 mfa_enrolment_required