Frontend endpoint index
- Written for
- ＋ Written for
- Deprecated
- ＋ Deprecated
- Applies to
- ＋ Applies to
Frontend endpoint index
The complete Frontend API surface — 122 endpoints. FAPI is browser- and native-facing: authenticated with a publishable key (x-publishable-key) plus the Atlas session (cookie on web, bearer on native). Most routes live under /v1/client/…. These are normally driven by an SDK, not called by hand.
Other client routes
Method & path | Description |
|---|---|
| The embeddable widget's public themeenabled providers/strategies, resolved by publishable key or host. Public only — no secrets, no customCss/customHtml. |
| Anti-bot signal beacon: the SDK posts anonymised devicebehavioural signals for the sign-in/sign-up form; the server enriches (salt-hashed IP, coarse geo, heuristic score) and appends to the bot_signals lake. Fire-and-forget (202), never blocks a sign-in. |
| Public read for an uploaded image (avatar/logo) — streamed from object storage with an immutable long cache-control. Unauthenticated by design; only validated images are ever stored here. |
| The instance's enabled social providers (and native client ids) for a publishable-key client. Never exposes secrets. |
Sign-in & sign-up
Method & path | Description |
|---|---|
| Start an emailpassword sign-up. Returns an attempt whose status drives the next step. |
| Reissue a verification code. Rate limited to 1/30s and 5/hour per address. |
| Submit an email verification code. Three attempts, then the code is invalidated. |
| Request a reset. Identical response for an address that does not exist. |
| Submit the emailed code. Advances to MFA when the account has it. |
| Second factor during a reset. Reset never bypasses MFA. |
| Set the new password, revoke every session, and bump sessions_version. |
| Start a sign-in. Returns the instance factor list, identical for unknown identifiers. |
| Start a QR cross-device sign-in: returns the QR token/verification URL, a number-match code, and this tab’s poll secret. Opt-in; unauthenticated (publishable key). |
| Phone lookup for a pending QR sign-in: the requesting browser’s devicecoarse location and the match code to confirm. Requires the phone’s session. |
| Phone approves a pending QR sign-in after confirming the number-match code; completes the attempt so the browser’s poll mints a session. Requires the phone’s session. |
| Phone denies a pending QR sign-in, abandoning the attempt so the browser’s poll never completes. Requires the phone’s session. |
| Send an email code or magic link. Returns the polling secret to this tab. |
| Magic-link target. Completes the attempt; signs in no one here. |
| Poll an attempt with its poll_secret; returns a ticket once complete. |
| Submit a first factor. Advances to MFA or completes, as the server decides. |
| Offer a passkey as the second factor. Credentials are named safely here. |
| Start TOTP enrollment for an attempt parked by a required MFA policy. |
| Confirm enrollment with two consecutive codes and complete the sign-in. |
| Submit a TOTP or recovery code. The only route out of needs_second_factor. |
| Begin passwordless sign-in. Names no user and lists no credentials. |
| Verify an assertion and issue a session. The credential names the user. |
| Begin an OAuth sign-in and receive the provider authorization URL. |
| Native / One-Tap sign-in: verify a provider id_token (Google GSI, Apple, Facebook Limited Login) and complete the sign-in, honouring the MFA gate. |
| LDAP/AD inbound sign-in: authenticate against a configured directory (connection_idusernamepassword) and JIT create/link the Atlas account, honouring the MFA gate. |
| Kerberos / Integrated Windows Auth (IWA / SPNEGO) sign-in: a reverse proxy authenticates the principal and forwards it in a header; Atlas trusts it only behind a matching x-atlas-kerberos-secret, then resolves/JIT-links the account honouring the MFA gate. Opt-in, fail-closed. |
| Migration interop: verify a foreign provider JWT (a configured externalJwt issuer) against its JWKS and complete the sign-in (JITMFA gate), to run Atlas alongside an old provider. |
| Begin an enterprise SSO sign-in. Resolves an OIDC connection by id or email domain and returns the IdP authorization URL. |
| Begin an enterprise SAML sign-in. Resolves a SAML connection by id or email domain and returns the IdP AuthnRequest URL. |
Account management (me)
Method & path | Description |
|---|---|
| Upload the signed-in user's avatar. The RAW image bytes are the body (Content-Type image/png|jpeg|gif|webp), validated by magic number; sets the user's image_url. Returns 503 when image storage is not configured. |
| List the signed-in user passkeys. Never returns credential material. |
| Options for navigator.credentials.create, with a single-use challenge. |
| Verify and store a new passkey. Requires a session. |
| Rename a passkey so the user can tell their devices apart. |
| Remove a passkey. Another user passkey id is 404, never 403. |
| List browsers trusted to skip 2FA (). Never returns the token hash. |
| Revoke one trusted device; its next sign-in must pass 2FA again. |
| Revoke every trusted device for the signed-in user. |
| List the third-party apps this user authorized (Sign in with <Tenant>). |
| Disconnect an authorized app: forget consent and revoke its live tokens. |
| The signed-in user with emails, linked accounts and passkeys. |
| Mint a scoped personal access token (uat_) so an agent or script can drive your own account over the me-surface with a bearer header. Session-only; the one-time secret is shown exactly once. |
| List your own personal access tokens with their scopes, expiry and last-used time. Never returns a secret or its hash. |
| Revoke one of your own personal access tokens. Revocation is immediate and a revoked token fails closed on every later use. |
| Discover the user-scoped MCP tools your personal access token can use, plus the recommended scope set for an account-management agent. |
| JSON-RPC MCP endpoint: manage your own account as MCP tools (read/update profile, list sessions, revoke-all, list factors and more), authenticated by a personal access token. |
| Request an export of your own data (Article 15/20). Creates an async job; poll for the produced package. Rate-limited: one in flight, and a cooldown between requests. |
| List your own data-export requests and their status. |
| A data-export request with, once ready, the produced package — your profile, emails, linked accounts, memberships and more, with no password hash, token or secret. |
| Request erasure of your own account (Article 17). Scheduled after a grace/cancellation window, then fulfilled through the same soft-deletePII-purge path a backend user-delete uses. |
| List your own erasure requests and their status. |
| Cancel a pending erasure within the grace window. A fulfilled one is a 409. |
| Cancel a pending erasure within the grace window (alias of /cancel). |
| Update profile and unsafe_metadata. public_metadata is refused. |
| Change your password. Verifies the current one, applies the sign-up policy, and revokes other sessions. |
| Set a first password on an account that has none (anonymous guest or OAuth-only). Applies the sign-up policy; may graduate a guest to a permanent account. |
| Add an address. Starts unverified and sends a code. |
| Verify an added address with its emailed code. |
| Make a verified address primary. Unverified addresses are refused. |
| Remove an address. Removing the last verified one is refused. |
| Unlink a provider. Removing the only sign-in method is refused. |
| The signed-in user's own provider access token, refreshed single-flight if stale. Never returns the refresh token. |
| Start an OAuth flow to link a NEW provider to the signed-in user (for a custom "Connect GitHub" button); returns the authorize URL. Binds to the current user, so no new session and no email resolution. |
| Re-initiate the provider OAuth flow to request additional scopes for a linked account; returns the authorize URL. On callback the account scopes/token update. |
| Revoke the stored provider token (best-effort at the provider) and clear it locally WITHOUT unlinking the account. |
| Organization memberships for the signed-in user. |
| Request to join an organization whose verified domain matches your verified email. |
| Organizations you could join, discovered via your verified email domain. |
| Accept a suggestion, creating a pending join request an admin then decides. |
| Step-up re-authentication: re-prove a credential (strategy "password" or "id_token") to refresh the session step-up window in place — no sign-out — so the next 2FA change is permitted. An id_token must already be linked to this user; it never attaches a new identity. |
| List the current user’s pending CIBA backchannel approval requests. |
| Approve or deny a pending CIBA backchannel request (session-only; a PAT cannot approve). |
Organizations (client)
Method & path | Description |
|---|---|
| Create an organization, if the instance allows user-created ones. |
| Read the active organization. Gated by the ACTIVE org role. |
| Update the active organization. Requires org:sys_profile:manage. |
| List members of the active organization as a display directory. |
| Invite someone. Requires org:sys_memberships:manage. |
| Remove a member. Removing the last admin returns LAST_ADMIN. |
| Accept an invitation addressed to one of your verified emails. Seats you as a member. |
| List pending requests to join the active org. Requires org:sys_memberships:manage. |
| Accept a join request, seating the user at the default member role (never admin). |
| Reject a pending join request. No membership is created. |
Multi-factor (me)
Method & path | Description |
|---|---|
| List the signed-in user second factors. Never returns secrets or codes. |
| Begin authenticator enrollment. Returns the secret exactly once. |
| Confirm enrollment with a code, and receive recovery codes once. |
| Enroll a phone as an SMS second factor. Texts a code; returns the number masked. |
| Confirm SMS enrollment with the texted code, and receive recovery codes once. |
| Register a device for in-house push MFA. Pushes a number-matching challenge; never returns the device token. |
| List registered push devices. Never returns the raw device token. |
| Device approve/denyselected number for a push challenge (enrollment or sign-in). |
| Remove a push device. Removing the last verified one removes the push factor. |
| Issue a fresh set of recovery codes, invalidating the previous set. |
| Remove a factor. Removing the last one also drops recovery codes. |
Web3, SAML-IdP & other sign-in
Method & path | Description |
|---|---|
| Atlas-as-SAML-IdP SSO endpoint (session-gated). IdP-initiated (?sp=) or SP-initiated (SAMLRequest); returns a signed SAML Response auto-POST form. |
| Atlas-as-SAML-IdP SSO endpoint (session-gated), HTTP-POST binding — see GET /v1/saml/idp/sso. |
| Atlas-as-SAML-IdP SSO endpoint (app.all method fan-out; behaves as GET/POST) — see GET /v1/saml/idp/sso. |
| Atlas-as-SAML-IdP SSO endpoint (app.all method fan-out; behaves as GET/POST) — see GET /v1/saml/idp/sso. |
| Atlas-as-SAML-IdP SSO endpoint (app.all method fan-out; behaves as GET/POST) — see GET /v1/saml/idp/sso. |
| Telegram Login Widget sign-in: verify the widget payload HMAC against the bot token and complete the sign-in, honouring the MFA gate. |
| Sign-in with Ethereum (EIP-4361): mint a single-use nonce bound to a new attempt. |
| Sign-in with Ethereum (EIP-4361): verify a signed message (domain, chain, nonce, validity, EIP-191/EIP-1271) and complete the sign-in, honouring the MFA gate. |
| Sign-in with Solana (SIWS): mint a single-use nonce bound to a new attempt. |
| Sign-in with Solana (SIWS): verify a signed message (domain, network, nonce, validity, ed25519 signature) and complete the sign-in, honouring the MFA gate. |
| Sign-in with Farcaster (SIWF): mint a single-use nonce bound to a new attempt. |
| Sign-in with Farcaster (SIWF): verify a signed SIWE message (domain, chain, nonce, validity, signature), prove on-chain that the custody address owns the claimed FID (Optimism ID Registry), and complete the sign-in, honouring the MFA gate. |
| DiscourseConnect provider endpoint. Verifies the forum HMAC (constant-time), authenticates via the hosted session, and signs the identity payload back to the return_sso_url whose origin is pinned to the connection. |
Tickets
Method & path | Description |
|---|---|
| Exchange a one-time ticket for session cookies. |
Client & sessions
Method & path | Description |
|---|---|
| Boot the client. Returns session: null for a signed-out visitor, never 401. |
| List the signed-in user's own active sessions/devices, flagging the current one. |
| Sign out of every other device. Spares the current session; bumps sessions_version. |
| Switch the active organization. Membership is resolved server-side. |
| Rotate the refresh token and mint a session JWT. Reads the refresh cookie only. |
| Revoke one session and clear its cookies. |
| Mint a short-lived JWT for the active session using a named JWT template (getToken). |
Billing (client)
Method & path | Description |
|---|---|
| Public list of the instance's active end-user billing plans for display (no Stripe price ids or secrets). |
| Create a Stripe Checkout Session to subscribe the signed-in user (or an org they administer) to a plan. Returns {url}; never changes subscription state. |
| Read the signed-in user's subscription, or an org's (org_id) when the caller is a member — status plus the active plan and its features. |
| Create a Stripe Billing Portal session for the subject's customer (self, or an org the caller administers) to manage or cancel. Returns {url}. |