Client Me
- Written for
- ＋ Written for
- Deprecated
- ＋ Deprecated
- Applies to
- ＋ Applies to
Client Me
Frontend API — publishable key (x-publishable-key) plus the user session.
54 routes. Each row is one endpoint with its explanation and whether it honours the Idempotency-Key header.
Method & path | Idem | Explanation |
|---|---|---|
| Upload the signed-in user's avatar. The RAW image bytes are the body (Content-Type image/png|jpeg|gif|webp), validated by magic number; sets the user's image_url. Returns 503 when image storage is not configured. | |
| List the signed-in user passkeys. Never returns credential material. | |
| Options for navigator.credentials.create, with a single-use challenge. | |
| Verify and store a new passkey. Requires a session. | |
| Rename a passkey so the user can tell their devices apart. | |
| Remove a passkey. Another user passkey id is 404, never 403. | |
| List browsers trusted to skip 2FA . Never returns the token hash. | |
| Revoke one trusted device; its next sign-in must pass 2FA again. | |
| Revoke every trusted device for the signed-in user. | |
| List the third-party apps this user authorized (Sign in with <Tenant>). | |
| Disconnect an authorized app: forget consent and revoke its live tokens. | |
| The signed-in user with emails, linked accounts and passkeys. | |
| Mint a scoped personal access token (uat_) so an agent or script can drive your own account over the me-surface with a bearer header. Session-only; the one-time secret is shown exactly once. | |
| List your own personal access tokens with their scopes, expiry and last-used time. Never returns a secret or its hash. | |
| Revoke one of your own personal access tokens. Revocation is immediate and a revoked token fails closed on every later use. | |
| Discover the user-scoped MCP tools your personal access token can use, plus the recommended scope set for an account-management agent. | |
| JSON-RPC MCP endpoint: manage your own account as MCP tools (read/update profile, list sessions, revoke-all, list factors and more), authenticated by a personal access token. | |
| Request an export of your own data (Article 15/20). Creates an async job; poll for the produced package. Rate-limited: one in flight, and a cooldown between requests. | |
| List your own data-export requests and their status. | |
| A data-export request with, once ready, the produced package — your profile, emails, linked accounts, memberships and more, with no password hash, token or secret. | |
| Request erasure of your own account (Article 17). Scheduled after a grace/cancellation window, then fulfilled through the same soft-delete + PII-purge path a backend user-delete uses. | |
| List your own erasure requests and their status. | |
| Cancel a pending erasure within the grace window. A fulfilled one is a 409. | |
| Cancel a pending erasure within the grace window (alias of /cancel). | |
| Update profile and unsafe_metadata. public_metadata is refused. | |
| Change your password. Verifies the current one, applies the sign-up policy, and revokes other sessions. | |
| Set a first password on an account that has none (anonymous guest or OAuth-only). Applies the sign-up policy; may graduate a guest to a permanent account. | |
| Add an address. Starts unverified and sends a code. | |
| Verify an added address with its emailed code. | |
| Make a verified address primary. Unverified addresses are refused. | |
| Remove an address. Removing the last verified one is refused. | |
| Unlink a provider. Removing the only sign-in method is refused. | |
| The signed-in user's own provider access token, refreshed single-flight if stale. Never returns the refresh token. | |
| Start an OAuth flow to link a NEW provider to the signed-in user (for a custom "Connect GitHub" button); returns the authorize URL. Binds to the current user, so no new session and no email resolution. | |
| Re-initiate the provider OAuth flow to request additional scopes for a linked account; returns the authorize URL. On callback the account scopes/token update. | |
| Revoke the stored provider token (best-effort at the provider) and clear it locally WITHOUT unlinking the account. | |
| Organization memberships for the signed-in user. | |
| Request to join an organization whose verified domain matches your verified email. | |
| Organizations you could join, discovered via your verified email domain. | |
| Accept a suggestion, creating a pending join request an admin then decides. | |
| List the signed-in user second factors. Never returns secrets or codes. | |
| Step-up re-authentication: re-prove a credential (strategy "password" or "id_token") to refresh the session step-up window in place — no sign-out — so the next 2FA change is permitted. An id_token must already be linked to this user; it never attaches a new identity. | |
| Begin authenticator enrollment. Returns the secret exactly once. | |
| Confirm enrollment with a code, and receive recovery codes once. | |
| Enroll a phone as an SMS second factor. Texts a code; returns the number masked. | |
| Confirm SMS enrollment with the texted code, and receive recovery codes once. | |
| Register a device for in-house push MFA. Pushes a number-matching challenge; never returns the device token. | |
| List registered push devices. Never returns the raw device token. | |
| Device approve/deny + selected number for a push challenge (enrollment or sign-in). | |
| Remove a push device. Removing the last verified one removes the push factor. | |
| Issue a fresh set of recovery codes, invalidating the previous set. | |
| Remove a factor. Removing the last one also drops recovery codes. | |
| List the current user’s pending CIBA backchannel approval requests. | |
| Approve or deny a pending CIBA backchannel request (session-only; a PAT cannot approve). |