Organization API: Customer Authentication: Staff

Part of Customer Authentication.

POST /api/v1/orgs/{org_slug}/staff/auth/change-password

Change your own password. Every other session you have is ended; the one making this request stays signed in.

application/json (required)

POST /api/v1/orgs/{org_slug}/staff/auth/customer-session

A fresh storefront session for the member's own customer account. The console restores it after a support session ends, or mints one when the member opens the storefront and has none.

POST /api/v1/orgs/{org_slug}/staff/auth/forgot-password

application/json (required)

POST /api/v1/orgs/{org_slug}/staff/auth/login

application/json (required)

POST /api/v1/orgs/{org_slug}/staff/auth/logout

End this console session and every storefront session it minted for the member, so signing out of the console signs them out of the site.

GET /api/v1/orgs/{org_slug}/staff/auth/me

PATCH /api/v1/orgs/{org_slug}/staff/auth/me

application/json (required)

GET /api/v1/orgs/{org_slug}/staff/auth/mfa

POST /api/v1/orgs/{org_slug}/staff/auth/mfa/disable

Turn the factor off: password and a current code, both. Refused when the brand requires a second factor of everyone; in that case an admin resets it from the team page instead, and the member enrols again.

application/json (required)

POST /api/v1/orgs/{org_slug}/staff/auth/mfa/enable

Confirm the code from the freshly scanned secret. Turns the factor on, hands out the recovery codes once and, when the caller was a pending enrolment session, issues the full session too.

application/json (required)

POST /api/v1/orgs/{org_slug}/staff/auth/mfa/recovery-codes

A new set of recovery codes against a current code; the old set is void.

application/json (required)

POST /api/v1/orgs/{org_slug}/staff/auth/mfa/setup

Start (or restart) enrolment: a fresh secret, the otpauth URI and the QR code for it. Nothing is enforced until enable confirms a code. Refused while a factor is already on; disable that one first.

POST /api/v1/orgs/{org_slug}/staff/auth/mfa/verify

The second step of signing in. Bearer is the pending token from login; a right code (or a recovery code) retires it and issues the full session. A session that is already full gets its step-up stamp refreshed instead, which is what reauth with a code does too.

application/json (required)

POST /api/v1/orgs/{org_slug}/staff/auth/reauth

Prove it is still you. A password, or a code when two-factor is on (the code is preferred and required once the factor exists, so a stolen password alone never reaches the step-up routes).

application/json (required)

POST /api/v1/orgs/{org_slug}/staff/auth/refresh

application/json (required)

POST /api/v1/orgs/{org_slug}/staff/auth/reset-password

application/json (required)

GET /api/v1/orgs/{org_slug}/staff/auth/sessions

POST /api/v1/orgs/{org_slug}/staff/auth/sessions/revoke-others

DELETE /api/v1/orgs/{org_slug}/staff/auth/sessions/{token_id}