Authentication

Bootstrap session payload#

One-shot endpoint returning user + organization + spaces + permissions for fast dashboard initialization. Replaces 3-4 sequential calls.

Antworten

• 200Bootstrap payload
• 401Not authenticated

curl -X GET "https://xapi.ambertech.cloud/api/v1/auth/bootstrap" \
  -H "Authorization: Bearer $XISUITE_TOKEN"

Exchange a Supabase auth code for a session#

Used by the password-reset confirmation page and other flows where the user lands on the frontend with a one-time `code` from a Supabase email link. Returns tokens and writes auth cookies.

Request-Bodyapplication/jsonExchangeCodeDto

Antworten

• 200Code exchanged — cookies set
• 400Invalid or expired code

curl -X POST "https://xapi.ambertech.cloud/api/v1/auth/exchange-code" \
  -H "Content-Type: application/json" \
  -d '{"code":"…"}'

Request password reset#

Sends a password reset email with a secure link. Always returns success to prevent email enumeration.

Request-Bodyapplication/jsonEmailDto

Antworten

• 200Password reset email sent (always returns success)

curl -X POST "https://xapi.ambertech.cloud/api/v1/auth/forgot-password" \
  -H "Content-Type: application/json" \
  -d '{"email":"user@example.com"}'

Get current user + tenant context#

Returns the authenticated user's profile alongside the multi-tenant context: the currently active organization (matching the active_org_id cookie) and every organization the caller is a member of. Replaces the legacy single-org `/auth/me` shape — callers that used to read `.organization_id` should now read `.activeOrganization.id`. `.user` carries the bare profile for back-compat.

Antworten

• 200User profile + tenant context
• 401Not authenticated

curl -X GET "https://xapi.ambertech.cloud/api/v1/auth/me" \
  -H "Authorization: Bearer $XISUITE_TOKEN"

Refresh access token for browser navigation#

Reads refresh_token from the HttpOnly cookie, rotates auth cookies, and redirects back to an allowlisted frontend URL.

Antworten

• 200OK

curl -X GET "https://xapi.ambertech.cloud/api/v1/auth/refresh"

Refresh access token#

Exchanges a refresh token for a new pair. Token is read from the body OR from the refresh_token cookie (browser-friendly). New cookies are written on the response.

Request-Bodyapplication/jsonRefreshTokenDto

Antworten

• 200Token refreshed — cookies rotated
• 401Invalid or expired refresh token

curl -X POST "https://xapi.ambertech.cloud/api/v1/auth/refresh" \
  -H "Content-Type: application/json" \
  -d '{"refreshToken":"pcnpngwwbrge"}'

Transfer a browser session to a published site origin#

Validates backend-owned HttpOnly cookies and redirects to an allowlisted published return URL with a short-lived bearer in the URL hash. The `/auth/refresh/transfer-session` alias is used by browsers so the path-scoped refresh_token cookie can recover expired access sessions.

Antworten

• 200OK

curl -X GET "https://xapi.ambertech.cloud/api/v1/auth/refresh/transfer-session"

Resend verification OTP#

Generates a new OTP for an unconfirmed user and sends it via email. Returns a generic response to prevent email enumeration.

Request-Bodyapplication/jsonEmailDto

Antworten

• 200Verification email resent
• 400Could not generate verification code

curl -X POST "https://xapi.ambertech.cloud/api/v1/auth/resend-verification" \
  -H "Content-Type: application/json" \
  -d '{"email":"user@example.com"}'

Sign in with email and password#

Authenticates a user with email/password. Returns the user profile and writes `access_token` + `refresh_token` HttpOnly cookies on the response. Cookie-based clients can rely on the browser to send these on subsequent requests; header-based clients can read the body tokens.

Request-Bodyapplication/jsonSigninDto

Antworten

• 200Sign-in successful — cookies set, body returns tokens + user
• 401Invalid email or password

curl -X POST "https://xapi.ambertech.cloud/api/v1/auth/signin" \
  -H "Content-Type: application/json" \
  -d '{"email":"prince@abjexperts.com","password":"Admin@123"}'

Sign out#

Invalidates the user's current session refresh token on the server and clears auth cookies. With `?everywhere=true`, revokes ALL of this user's sessions across devices.

Parameter

Antworten

• 200Signed out successfully

curl -X POST "https://xapi.ambertech.cloud/api/v1/auth/signout" \
  -H "Authorization: Bearer $XISUITE_TOKEN"

Register a new user#

Creates a new user account via Supabase Auth and sends an OTP verification email. The database trigger `handle_new_user` automatically creates the public.users profile.

Request-Bodyapplication/jsonSignupDto

Antworten

• 200Signup successful — OTP email sent
• 400Validation error or signup failed
• 503Verification email could not be sent (code: email_send_failed) — the account is created; retrying signup re-sends the OTP once mail delivery is fixed

curl -X POST "https://xapi.ambertech.cloud/api/v1/auth/signup" \
  -H "Content-Type: application/json" \
  -d '{"firstName":"Prince","lastName":"Jadiya","email":"user@example.com","password":"SecurePass123"}'

Transfer a browser session to a published site origin#

Validates backend-owned HttpOnly cookies and redirects to an allowlisted published return URL with a short-lived bearer in the URL hash. The `/auth/refresh/transfer-session` alias is used by browsers so the path-scoped refresh_token cookie can recover expired access sessions.

Antworten

• 200OK

curl -X GET "https://xapi.ambertech.cloud/api/v1/auth/transfer-session"

Update password#

Changes the password for the currently authenticated user. Token is read from the access_token cookie or the Authorization header.

Request-Bodyapplication/jsonUpdatePasswordDto

Antworten

• 200Password updated successfully
• 400Failed to update password

curl -X POST "https://xapi.ambertech.cloud/api/v1/auth/update-password" \
  -H "Authorization: Bearer $XISUITE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"password":"NewSecurePass456"}'

Verify email with OTP#

Verifies the user's email using the OTP code. Returns JWT tokens and writes auth cookies.

Request-Bodyapplication/jsonVerifyOtpDto

Antworten

• 200OTP verified — cookies set
• 400Invalid or expired OTP

curl -X POST "https://xapi.ambertech.cloud/api/v1/auth/verify-otp" \
  -H "Content-Type: application/json" \
  -d '{"email":"user@example.com","token":"123456"}'