session
Opaque local-session lifecycle and optional browser OIDC sign-in
List current-member external sign-in methods
List current-member external sign-in methods
Link a verified LDAP/AD credential to the current member
Link a verified LDAP/AD credential to the current member
Begin an OIDC identity-linking ceremony
Requires a normal authenticated session and same-origin request. The verified callback can only add a credential to that exact recently authenticated local account; it cannot admit a new account or issue a replacement session.
Link the protected proxy assertion to the current member
Link the protected proxy assertion to the current member
Unlink an external sign-in method after a recent sign-in
Revokes every active session issued by the unlinked identity. The last interactive credential cannot be removed.
Verify a TLS-protected LDAP/AD password and issue a local session
Verify a TLS-protected LDAP/AD password and issue a local session
Report enabled browser sign-in methods
Report enabled browser sign-in methods
Complete the OIDC browser callback
Consumes the one-use OIDC state and creates the normal opaque Jiandu session before redirecting to the application. Browser JavaScript never receives the provider token.
Begin an OIDC authorization-code + PKCE browser flow
Requires same-origin JSON. The result is an authorization URL and a short-lived host-only HttpOnly SameSite=Lax correlation cookie; no provider tokens are returned to browser JavaScript.
List current-member passkey metadata
List current-member passkey metadata
Consume a passkey assertion and issue an opaque session
Consume a passkey assertion and issue an opaque session
Begin username-first passkey authentication
Begin username-first passkey authentication
Atomically consume an invitation, persist a passkey, and issue a session
Atomically consume an invitation, persist a passkey, and issue a session
Begin invitation-backed passkey admission
Begin invitation-backed passkey admission
Verify and persist a passkey for the current member
Verify and persist a passkey for the current member
Begin passkey enrollment after a recent ordinary sign-in
Begin passkey enrollment after a recent ordinary sign-in
Revoke one current-member passkey after a recent sign-in
Revoke one current-member passkey after a recent sign-in
Exchange a protected reverse-proxy assertion for a local session
Accepted only from a configured direct proxy peer supplying the deployment secret and bounded identity headers. Client-supplied identity headers alone are never authority.
Revoke supplied session credentials and expire a supplied browser cookie
Logout is idempotent. A cookie, ordinary bearer session, both, or neither may be supplied; any supplied recognized session credentials are revoked. Personal access tokens cannot use this credential-management route. Browser requests are subject to same-origin checks.
Verify the current session and rotate it when due
Supply exactly one credential source: the session cookie or an opaque bearer token. Rotation preserves the response shape and may include a replacement Set-Cookie header.
Exchange a local recovery token or username/password for an opaque session
The recovery token or password is accepted only in this JSON body and is never persisted by the session store. Browser requests are subject to same-origin Fetch Metadata and Origin checks. The returned credential is set as a host-only HttpOnly SameSite=Strict cookie.