v10

latestOpenAPI 3.0.0raw.githubusercontent.com2026-07-0582185581.9 KB

User Account

Initialize authentication session

Start a server-side authentication session and discover which sign-in methods are configured for the organization. This is the first step in the multi-step login flow.

Request body (optional)

You may omit the body, send an empty JSON object {}, or send { "email": "..." }.
email in the body is optional and kept for legacy reasons; omitting it does not prevent initialization. The web client typically calls this endpoint without a body and sends email on /authenticate instead.
When provided, email is stored on the session for correlation with subsequent steps.

Flow:

Call this endpoint (optional JSON body as above).
Receive a session token in the x-session-token response header.
Send that token on subsequent /authenticate requests (x-session-token header).
Use allowedMethods and authProviders from the response to render the login UI.

Session token

Returned as header x-session-token.
Required for /authenticate (and related steps) until it expires.

Multi-factor authentication

If the organization has MFA, complete multiple authentication steps; each step may return the next step's allowed methods.

post/userAccount/initAuth

Request body

emailstring email

Optional; retained for legacy reasons. When set, stored on the auth session for correlation with later /authenticate calls (RFC 5321 compliant address).

Example request

{
  "email": "user@example.com"
}

Response

Authentication session initialized successfully

currentStepinteger required

Current authentication step (0-indexed). Always 0 for initial response.

allowedMethodsstring[] required

List of allowed authentication methods for the current step

messagestring required

Response message

jitEnabledboolean required

True when at least one allowed external provider has JIT provisioning enabled

Example response

{
  "allowedMethods": [
    "password",
    "google",
    "otp"
  ],
  "message": "Authentication initialized"
}