Atlas API Reference

Atlas is a complete authentication and identity platform. This reference documents every public HTTP surface, the conventions that hold across all of them, and the SDKs that wrap them.

Atlas exposes three developer surfaces, each with its own audience and credential:

The one rule that governs everything: authentication and authorization are enforced on the server. Client SDKs decide what a user sees; only a check on the request decides what they can do.

Where to start

• Authentication — publishable vs secret keys, how each surface authenticates.

• Base URLs & surfaces — which host to call for what.

• Errors, Pagination, Idempotency, Rate limits, Versioning — the cross‑cutting conventions.

• Backend API overview — the sk_ management surface, resource by resource.

• SDKs — official libraries for 8 frontend frameworks, 7 backend languages, and 3 mobile platforms.

Conventions at a glance

• JSON everywhere. Request and response bodies are JSON; the wire is snake_case.

• Stable, string ids. user_…, org_…, sess_…. Ids are opaque — do not parse them.

• Epoch‑millisecond timestamps. Fields like created_at are integers, not ISO strings.

• Cross‑tenant reads return 404, never 403. A 403 would confirm a resource exists in another instance — itself a disclosure.

• Secrets are revealed exactly once. Client secrets, webhook signing secrets, API‑key and SCIM‑token secrets are shown at creation and never read back.

This reference is grounded in the live Atlas API. Endpoint signatures, scopes, error codes, and the webhook signature scheme are taken directly from the running service.