/api/auth/password/verify
Verify the caller's own password
/api/auth/password
Change the caller's own password
/api/auth/password/reset
Replace the caller's password without a session, or challenge for the second factor.
/api/auth/login-settings
Everything the login page renders itself from, for the requested host.
/api/auth/login
Mint a session, or challenge for the second factor the account owes.
/api/auth/login/totp
Mint a session for a password plus a valid TOTP code.
/api/auth/login/webauthn
Mint a session for a password plus a verified authenticator assertion.
/api/auth/login/sso-exchange
Return the session cookies for a session the identity provider's callback already created.
/api/auth/totp/enrollment
Start a TOTP enrollment for the caller
/api/auth/totp/enrollment/verify
Confirm a TOTP enrollment with a generated code
/api/auth/second-factor
Clear the caller's enrolled second factor
/api/auth/session/refresh
Extend the caller's session and re-issue its token
/api/auth/logout
End the caller's session, or every session they hold
/api/auth/sso/login-url
The provider's authorization URL, for the login page to follow.
/api/auth/sso/{sso_id}/login
Redirect the browser to the provider behind `sso_id`.
/api/auth/sso/{saml_id}/metadata
The SP metadata document an administrator uploads to their provider.
/api/auth/webauthn/enrollment
Start a WebAuthn enrollment for the caller
/api/auth/webauthn/enrollment/verify
Confirm a WebAuthn enrollment with the authenticator's attestation
/api/auth/webauthn/challenge
Issue a WebAuthn assertion challenge for the caller
/api/catalog/user-images
List launchable images for the caller (or another user, with elevated perms)
/api/catalog/default-images
The authenticated user's default workspace image, from user and group settings
/api/identity/users/{user_id}
Get a user by id
/api/identity/users/{user_id}
Partial update. A field omitted from the body is left unchanged. A field sent as null is cleared if the request schema marks it nullable; null on any other field is rejected with 422.
/api/identity/users
List users matching a username (zero or one)
/api/identity/users/{user_id}/attributes
Get a user's self-service profile attributes
/api/identity/users/{user_id}/attributes
Partial update. A field omitted from the body is left unchanged. A field sent as null is cleared if the request schema marks it nullable; null on any other field is rejected with 422.
/api/identity/users/{user_id}/permissions
Get a user's resolved group permissions
/api/identity/user-auth-settings
Get the caller's own auth/2FA settings
/api/infrastructure/zone-options
List deployment-zone selector options (paginated)
/api/identity/users/{user_id}/usage-summary
The caller's usage-limit setting and hours used against it
/api/identity/users/{user_id}/usage-sessions
The caller's session history over the trailing 30 days (paginated)
/api/platform/version
Server version, for selecting a matching generated SDK
/api/__healthcheck
Readiness probe: can this process serve a request right now
/api/platform/client-settings
Effective client-facing session settings for the authenticated user
/api/platform/languages
Supported UI languages, for the client's language dropdown
/api/platform/timezones
Supported UI timezones, for the client's timezone dropdown
/api/platform/help-links/{doc_id}
Resolve a documentation link, falling back to the generic admin guide on failure
/api/platform/rdp-client-connections/file
Signed .rdp file for a session
/api/platform/rdp-client-connections/url
rdp:// URL for a session
/api/platform/rdp-client-connections/settings
RDP client settings for a session, creating one if needed
/api/providers/egress-gateway-options
Computed for the calling user. An API key has no user and is refused (403); the /api/admin/providers option lists take the user explicitly.
/api/providers/egress-provider-options
Computed for the calling user. An API key has no user and is refused (403); the /api/admin/providers option lists take the user explicitly.
/api/providers/storage-provider-options
List the enabled storage providers the caller may map (paginated)
/api/providers/storage-mappings
List the storage mappings bound to a user, group, or image (paginated)
/api/providers/storage-mappings
Create a storage mapping for a provider that takes credentials directly
/api/providers/storage-mappings/{storage_mapping_id}
Get a single storage mapping by id
/api/providers/storage-mappings/{storage_mapping_id}
Partial update. A field omitted from the body is left unchanged. A field sent as null is cleared if the request schema marks it nullable; null on any other field is rejected with 422.
/api/providers/storage-mappings/{storage_mapping_id}
Delete a storage mapping
/api/providers/storage-mapping-oauth-logins
Start the OAuth login that creates a storage mapping for an OAuth provider
/api/tenant/license-status
Effective license status for the current deployment
/api/tenant/subscription
Stripe billing configuration and current subscription