Accounts

postAdd Connection

Links a new identity provider (GitHub, Discord, or password) to the authenticated user's account. Only one connection per provider type is allowed. **Required scopes:** `auth:account:edit`

postDelete Passkey

Removes one of the authenticated user's passkeys. Requires a recent login (step-up). **Required scopes:** `auth:account:edit`

Disables org-account two-factor authentication. Requires a current TOTP or recovery code to prove possession of the second factor (used instead of the account password so password-less accounts can disable). **Required scopes:** `auth:account:edit`

postEnroll MFA

Generates a new TOTP secret + provisioning URI for the authenticated user to add to an authenticator app. Requires a recent login (step-up). Enrollment is not active until confirmed via VerifyMfaEnrollment. **Required scopes:** `auth:account:edit`

postGet Account

Retrieves the full account details for the authenticated user, including connected external accounts and application enrollments. **Required scopes:** `auth:account:read`

postGet MFA Status

Returns whether org-account two-factor authentication is enabled for the authenticated user and how many recovery codes remain. **Required scopes:** `auth:account:read`

postList Accounts

Returns a paginated list of user accounts. Supports filtering by username. **Required scopes:** `auth:users:read`

postList Passkeys

Returns the authenticated user's registered passkeys. **Required scopes:** `auth:account:read`

postBegin Passkey Registration

Starts a WebAuthn registration: returns PublicKeyCredentialCreationOptions (resident-key required) plus a session id. Requires a recent login (step-up), like enabling 2FA. **Required scopes:** `auth:account:edit`

postComplete Passkey Registration

Verifies the attestation and stores the passkey for the authenticated user. Requires a recent login (step-up). **Required scopes:** `auth:account:edit`

postRegenerate MFA Recovery Codes

Generates a fresh set of one-time recovery codes, invalidating the old set. Requires a current TOTP or recovery code to prove possession of the second factor. **Required scopes:** `auth:account:edit`

postRemove Connection

Unlinks an identity provider from the authenticated user's account. At least one connection must remain. **Required scopes:** `auth:account:edit`

postSet Primary Email

Sets the primary email address for the authenticated user. The email must match one of the trusted emails from the user's existing connections. **Required scopes:** `auth:account:edit`

postUpload Avatar

Uploads a custom avatar image for the authenticated user. This will prevent future automatic syncs from identity providers. **Required scopes:** `auth:account:edit`

postVerify MFA Enrollment

Confirms a pending org-account MFA enrollment by validating a TOTP code from the authenticator app, activates 2FA, and returns one-time recovery codes. Requires a recent login (step-up). **Required scopes:** `auth:account:edit`

PRIVATEAccounts