/

/Hikyo API

Changes Docs Sign in

Docs
History
Schema

Filter operations

access42

accounts1

adapters26

approvals7

audit6

auth51

post/api/v1/auth/credential/establishConsume a credential-establishment authority and set an initial credential.
post/api/v1/auth/local/loginLocal password login; mints a CLI or browser session artifact.
post/api/v1/auth/login/challenge/{challenge}/totpSatisfy a login challenge with a TOTP code; mints the session.
post/api/v1/auth/login/challenge/{challenge}/webauthn/startBegin a passkey assertion against a login challenge.
post/api/v1/auth/login/challenge/{challenge}/webauthn/finishComplete a passkey assertion against a login challenge; mints the session.
post/api/v1/auth/logoutRevoke the presented session.
get/api/v1/auth/whoamiDescribe the presented session.
post/api/v1/auth/totp/enrol/startBegin TOTP enrolment; returns the otpauth URI once.
post/api/v1/auth/totp/enrol/confirmConfirm TOTP enrolment with a code; reissues the session.
post/api/v1/auth/totp/step-upElevate the acting session by presenting a TOTP code.
post/api/v1/auth/reauth/totpOpen a disclosure reauthentication window with a TOTP code.
post/api/v1/auth/cli-reauth/startBind an adapter reauthentication handoff to the acting CLI session and PKCE challenge.
get/api/v1/auth/cli-reauth/transactions/{state}Load display-only policy and exact callback metadata for a live CLI handoff.
post/api/v1/auth/cli-reauth/approveApprove a CLI adapter ceremony with the browser session's exact bound windows.
post/api/v1/auth/cli-reauth/redeemAtomically exchange code and PKCE verifier for the rotated CLI bearer.
get/api/v1/auth/totpReport whether the caller has a TOTP factor.
delete/api/v1/auth/totpRemove the confirmed TOTP factor.
post/api/v1/auth/recovery-codes/regenerateReplace the recovery-code batch; returns the codes once.
post/api/v1/auth/recovery/beginConsume a recovery code for a credential-establishment authority.
post/api/v1/auth/signupRequest local email registration.
post/api/v1/auth/signup/verifyVerify one local registration without minting a session.
get/api/v1/auth/methodsEnabled login methods for this instance.
post/api/v1/auth/oidc/{provider}/startBegin an OIDC transaction (login, link, reauth or claim).
get/api/v1/auth/oidc/{provider}/callbackComplete an OIDC transaction from the IdP redirect.
post/api/v1/auth/oauth2/{provider}/startBegin an OAuth2 transaction (login, link, establish or claim).
get/api/v1/auth/oauth2/{provider}/callbackComplete an OAuth2 transaction from the IdP redirect.
post/api/v1/auth/saml/{provider}/startBegin an SP-initiated SAML transaction (login, link or reauth).
post/api/v1/auth/saml/{provider}/acsComplete an SP-initiated SAML transaction over HTTP-POST.
get/api/v1/auth/saml/{provider}/metadataPublish this provider's SAML SP metadata.
get/api/v1/me/profileRead your own account profile.
patch/api/v1/me/profileUpdate your own account profile.
get/api/v1/me/orgsThe organisations the caller's own grants name.
get/api/v1/auth/identitiesList the caller's linked external identities.
post/api/v1/auth/identities/linkBegin linking an external identity (OIDC purpose=link).
delete/api/v1/auth/identities/{id}Unlink an external identity.
post/api/v1/auth/webauthn/enrol/startBegin passkey enrolment; returns opaque creation options.
post/api/v1/auth/webauthn/enrol/finishComplete passkey enrolment from the attestation response.
post/api/v1/auth/webauthn/login/startBegin a discoverable-credential passkey login.
post/api/v1/auth/webauthn/login/finishComplete a passkey login from the assertion response.
post/api/v1/auth/webauthn/step-up/startBegin a passkey step-up for the acting session.
post/api/v1/auth/webauthn/step-up/finishElevate the acting session by presenting a passkey.
post/api/v1/auth/webauthn/reauth/startBegin a passkey reauthentication bound to an operation unit.
post/api/v1/auth/webauthn/reauth/finishComplete a passkey reauthentication; opens the window.
get/api/v1/auth/webauthn/credentialsList the caller's enrolled passkeys.
delete/api/v1/auth/webauthn/credentials/{id}Remove an enrolled passkey.
post/api/v1/auth/workspace/startOpen a workspace handoff transaction.
post/api/v1/auth/workspace/approveApprove a handoff as the authenticated human, minting the code.
post/api/v1/auth/workspace/redeemExchange code + PKCE verifier for a workspace session.
get/api/v1/auth/workspace/transactions/{state}Load the authoritative shape of a live workspace handoff.
get/api/v1/me/sessionsThe caller's own active sessions, workspace sessions included.
delete/api/v1/me/sessions/{session}Revoke one of the caller's own sessions.

definitions7

delivery6

dynamic12

environments2

hierarchy24

identities15

instance55

keys14

meta2

orgs2

pki24

revisions12

scim14

scim-protocol19

ssh17

transit15

values15

auth

Changes to Verify one local registration without minting a session.

post/api/v1/auth/signup/verify

Oct 2, 2026d98e996af141 Revision changes
- info
  endpoint added