{"service":"bsso","name":"BSafe Group SSO","description":"Single sign-on for BSafe Group - one account for every internal service","issuer":"user-api.bsafegroup.be","base_url":"https://user-api.bsafegroup.be","portal":"https://user.bsafegroup.be","api":"/api/v1","health":"/health","endpoint_count":58,"endpoints":[{"group":"auth","method":"POST","path":"/api/v1/auth/login","auth":"none","summary":"Sign in with an email and a password - answers with a session or a challenge"},{"group":"auth","method":"POST","path":"/api/v1/auth/challenge","auth":"none","summary":"Answer a security-question challenge and finish signing in"},{"group":"auth","method":"POST","path":"/api/v1/auth/refresh","auth":"refresh cookie","summary":"Mint a new access token and rotate the refresh cookie"},{"group":"auth","method":"POST","path":"/api/v1/auth/logout","auth":"refresh cookie","summary":"End this session"},{"group":"auth","method":"GET","path":"/api/v1/auth/security-questions","auth":"none","summary":"The catalogue of security questions an account may choose from"},{"group":"auth","method":"GET","path":"/api/v1/auth/invitations/:token","auth":"the link","summary":"Who an invitation is for"},{"group":"auth","method":"POST","path":"/api/v1/auth/invitations/:token/accept","auth":"the link","summary":"Set the first password and sign in"},{"group":"auth","method":"GET","path":"/api/v1/auth/password-resets/:token","auth":"the link","summary":"Who a password reset link is for"},{"group":"auth","method":"POST","path":"/api/v1/auth/password-resets/:token/accept","auth":"the link","summary":"Choose a new password - signing in afterwards is a separate step"},{"group":"account","method":"GET","path":"/api/v1/users/me","auth":"bearer","summary":"This account's profile"},{"group":"account","method":"PATCH","path":"/api/v1/users/me","auth":"bearer","summary":"Change this account's name or details"},{"group":"account","method":"DELETE","path":"/api/v1/users/me","auth":"bearer","summary":"Delete this account, confirmed with its password"},{"group":"account","method":"POST","path":"/api/v1/users/me/password","auth":"bearer","summary":"Change this account's password"},{"group":"account","method":"GET","path":"/api/v1/users/me/security-questions","auth":"bearer","summary":"Which security questions are set - never the answers"},{"group":"account","method":"PUT","path":"/api/v1/users/me/security-questions","auth":"bearer","summary":"Replace this account's security questions"},{"group":"account","method":"GET","path":"/api/v1/users/me/sessions","auth":"bearer","summary":"Where this account is signed in"},{"group":"account","method":"DELETE","path":"/api/v1/users/me/sessions","auth":"bearer","summary":"Sign out every session except this one"},{"group":"account","method":"DELETE","path":"/api/v1/users/me/sessions/:id","auth":"bearer","summary":"Sign out one session"},{"group":"account","method":"GET","path":"/api/v1/users/me/activity","auth":"bearer","summary":"This account's own activity feed"},{"group":"account","method":"POST","path":"/api/v1/users/me/avatar","auth":"bearer","summary":"Replace the profile picture - a base64 image in the body"},{"group":"account","method":"DELETE","path":"/api/v1/users/me/avatar","auth":"bearer","summary":"Remove the profile picture"},{"group":"account","method":"GET","path":"/api/v1/users/me/authorizations","auth":"bearer","summary":"Which applications this account has authorised, and for what"},{"group":"account","method":"DELETE","path":"/api/v1/users/me/authorizations/:id","auth":"bearer","summary":"Withdraw one application's authorisation"},{"group":"vault","method":"GET","path":"/api/v1/users/me/otp-accounts","auth":"bearer","summary":"The two-factor codes this account keeps here"},{"group":"vault","method":"POST","path":"/api/v1/users/me/otp-accounts","auth":"bearer","summary":"Store a two-factor secret"},{"group":"vault","method":"PATCH","path":"/api/v1/users/me/otp-accounts/:id","auth":"bearer","summary":"Relabel one - labels only, never the seed"},{"group":"vault","method":"POST","path":"/api/v1/users/me/otp-accounts/:id/advance","auth":"bearer","summary":"Spend the current counter on a counter-based code"},{"group":"vault","method":"DELETE","path":"/api/v1/users/me/otp-accounts/:id","auth":"bearer","summary":"Forget one"},{"group":"oauth","method":"GET","path":"/api/v1/apps","auth":"bearer","summary":"The applications this account can reach"},{"group":"oauth","method":"GET","path":"/api/v1/oauth/authorize","auth":"none","summary":"Where a client sends the browser to start a sign-in"},{"group":"oauth","method":"POST","path":"/api/v1/oauth/token","auth":"client","summary":"Exchange an authorization code, or a refresh token, for credentials"},{"group":"oauth","method":"POST","path":"/api/v1/oauth/revoke","auth":"client","summary":"Revoke a token"},{"group":"oauth","method":"GET","path":"/api/v1/oauth/userinfo","auth":"OAuth bearer","summary":"Claims about the signed-in account, filtered by the granted scopes"},{"group":"oauth","method":"GET","path":"/api/v1/oauth/consent","auth":"bearer","summary":"What an application is asking this account to allow"},{"group":"oauth","method":"POST","path":"/api/v1/oauth/consent","auth":"bearer","summary":"Allow it or refuse it"},{"group":"oauth","method":"GET","path":"/api/v1/oauth/clients","auth":"admin:clients:read","summary":"Registered applications"},{"group":"oauth","method":"POST","path":"/api/v1/oauth/clients","auth":"admin:clients:write","summary":"Register an application - the only response carrying a client secret"},{"group":"oauth","method":"DELETE","path":"/api/v1/oauth/clients/:id","auth":"admin:clients:write","summary":"Remove a registration"},{"group":"admin","method":"GET","path":"/api/v1/admin/stats","auth":"admin:access","summary":"The counts on the console's overview"},{"group":"admin","method":"GET","path":"/api/v1/admin/users","auth":"admin:users:read","summary":"The user directory - ?q= filters it"},{"group":"admin","method":"POST","path":"/api/v1/admin/users/invitations","auth":"admin:users:write","summary":"Invite a colleague, or resend an invitation nobody has accepted"},{"group":"admin","method":"GET","path":"/api/v1/admin/users/:id","auth":"admin:users:read","summary":"One account in detail - counts of its credentials, sessions and applications, never their contents"},{"group":"admin","method":"POST","path":"/api/v1/admin/users/:id/invitation","auth":"admin:users:write","summary":"A new invitation link for an account still invited - the earlier one stops working"},{"group":"admin","method":"GET","path":"/api/v1/admin/users/:id/activity","auth":"admin:users:read","summary":"One account's sign-in history - ?limit= bounds it"},{"group":"admin","method":"GET","path":"/api/v1/admin/users/:id/sessions","auth":"admin:users:read","summary":"Where one account is signed in"},{"group":"admin","method":"PATCH","path":"/api/v1/admin/users/:id","auth":"admin:users:write","summary":"Change somebody's name, address or roles, or suspend and reinstate them"},{"group":"admin","method":"DELETE","path":"/api/v1/admin/users/:id","auth":"admin:users:write","summary":"Delete an account and everything it held - the address must be typed"},{"group":"admin","method":"POST","path":"/api/v1/admin/users/:id/password-reset","auth":"admin:users:write","summary":"Issue a one-time password reset link and end every session the account has"},{"group":"admin","method":"POST","path":"/api/v1/admin/users/:id/security-questions-reset","auth":"admin:users:write","summary":"Clear an account's security questions and end every session it has"},{"group":"admin","method":"POST","path":"/api/v1/admin/users/:id/sessions/revoke","auth":"admin:users:write","summary":"Sign an account out of every device and connected application"},{"group":"admin","method":"DELETE","path":"/api/v1/admin/users/:id/sessions/:session_id","auth":"admin:users:write","summary":"End one of an account's sessions"},{"group":"admin","method":"POST","path":"/api/v1/admin/users/:id/password","auth":"admin:users:write","summary":"Set a temporary password, generated or typed, and end every session the account has"},{"group":"admin","method":"GET","path":"/api/v1/admin/logs","auth":"admin:logs:read","summary":"The system log - ?severity= filters it"},{"group":"service","method":"GET","path":"/","auth":"none","summary":"This document - every endpoint this API serves"},{"group":"service","method":"GET","path":"/api/v1","auth":"none","summary":"This document, under the API prefix"},{"group":"service","method":"GET","path":"/health","auth":"none","summary":"Liveness and the schema version - 503 when the schema is behind"},{"group":"service","method":"GET","path":"/api/v1/health","auth":"none","summary":"The same check, under the API prefix"},{"group":"service","method":"GET","path":"/api/v1/avatars/{file}","auth":"none","summary":"A profile picture, off disk - the URL is the credential, see avatar_routes.salam"}]}