# Nauthera Public API

The public HTTP API of nauthera-server. Nauthera is a self-hosted OAuth 2.0
and OpenID Connect identity provider for Kubernetes, written in Go.

The API serves OpenID Connect Discovery 1.0 and RFC 8414 authorization
server metadata, the JSON Web Key Set, the authorization endpoint
(authorization code with PKCE), pushed authorization requests (RFC 9126),
the token endpoint (authorization code, refresh token, client credentials
and device code grants), device authorization (RFC 8628), token
introspection and revocation, UserInfo, RP-initiated logout, dynamic client
registration and management (RFC 7591, RFC 7592), the endpoints behind the
hosted sign-in pages, and the admin API under `/v1/admin`.

Tokens can be sender-constrained with DPoP (RFC 9449), and authorization
responses identify their issuer (RFC 9207), as the OAuth 2.0 Security Best
Current Practice (RFC 9700) recommends. Which specifications are
implemented, in full or in part, is listed at
https://www.nauthera.io/standards.

## Base URL

Paths are relative to an organization's issuer URL: the server root for the main organization, `/orgs/{slug}` for every other one.

- `https://auth.example.com`: Production issuer (replace with your issuer.url)
- `http://localhost:8080`: Local development (just run)

## Authentication

### Bearer token (`bearerAuth`)

Token format: JWT.

A bearer (or DPoP) access token issued by this provider.

### HTTP Basic (`clientSecretBasic`)

Confidential-client credentials via HTTP Basic (client_secret_basic).

### Registration access token (`registrationAccessToken`)

The RFC 7592 registration access token for client management.

### Initial access token (`initialAccessToken`)

The RFC 7591 §1.2 initial access token: an OAuth 2.0 access token carrying the `nauthera.clients:register` scope, which authorizes calls to the client registration endpoint and supplies the organization the new client is bound to. RFC 7591 §3 makes open (unauthenticated) registration a SHOULD; this deployment deviates deliberately, because every client here belongs to an org and an anonymous registrant has none.

### OAuth 2.0 (`oauth2`)

OAuth 2.0 access tokens used to authorize the admin REST surface
(`/v1/admin/**`). Two flows are advertised, both minting tokens against
this provider's `/token` endpoint:

- **authorizationCode** (PKCE, RFC 7636) — an interactive operator signs
  in to their organization's admin-console client (a public PKCE client
  auto-provisioned per org) and receives an access token carrying the
  granted OAuth scopes (below). The caller's roles are read from
  `user_org_roles` on every request, not taken from the token.
- **clientCredentials** (RFC 6749 §4.4) — a confidential machine-to-machine
  admin client exchanges its `client_id`/`client_secret` for an access
  token carrying the scopes its registration grants (and any admin roles
  bound to it through reserved client labels). Used for headless
  automation of the admin surface.

Authorization on every admin operation is the CONJUNCTION of two
independent checks: the token's `scope` claim MUST contain the operation's
declared scope (validated via `oauthsrv.HasScope`) AND the caller MUST
hold the permission the operation declares in its `x-permission`,
resolved from their roles through a fixed table (`internal/rbac`). A
token that carries the scope but whose caller lacks the permission — or
the reverse — is rejected. A scope caps what a client may do on its
user's behalf; a permission is what that user may do at all.
`x-permissions` below is the closed permission vocabulary, and the
server's handlers are held to each operation's declaration by a test.
The users and audit scopes below are org-scoped: a caller acts only
within its own org unless a platform role held in the main org admits it
to every org. The clients, sessions, insights, threats and roles scopes
are the admin dashboard's, registered by every organization's admin console
alone; like every scope they cap what a client may ask for, and the
permission each operation declares does the fine-grained work.

`x-permission` also declares whether the operation requires a recent
sign-in. A token whose sign-in is older than the deployment allows
(fifteen minutes by default), states none, or lacks a second factor the
deployment requires is answered 401 `insufficient_user_authentication`,
with an RFC 9470 challenge carrying `max_age` (and `acr_values`): sign
in again and replay the call.

#### Authorization code flow

- Authorization URL: `https://auth.example.com/authorize`
- Token URL: `https://auth.example.com/token`
- Refresh URL: `https://auth.example.com/token`
- Scope `openid`: OpenID Connect authentication (issue an ID token).
- Scope `profile`: Basic profile claims (name, preferred_username, …).
- Scope `email`: Email-address claims (email, email_verified).
- Scope `offline_access`: Issue a refresh token for long-lived access.
- Scope `nauthera.orgs:read`: Read organizations through the admin API (list and get). Pairs with the orgs.read permission: held in an organization, it reads that organization; listing them, and reading any other, takes a platform role held in the main org.
- Scope `nauthera.orgs:write`: Create, update and delete organizations through the admin API. Pairs with the orgs.write permission, which only a platform role held in the main org grants.
- Scope `nauthera.users:read`: Read local users through the admin API (list and get). Pairs with the users.read permission; confined to the caller's own org unless a platform role held in the main org admits it to every org.
- Scope `nauthera.users:write`: Create, update, delete, suspend, block, reactivate and unlock local users, set their passwords and email them reset links through the admin API. Pairs with the users.create, users.update, users.delete, users.lifecycle or users.credentials permission, whichever the operation declares; confined to the caller's own org unless a platform role held in the main org admits it to every org.
- Scope `nauthera.audit:read`: Read the audit log through the admin API. Pairs with the audit.read permission; confined to the caller's own org unless a platform role held in the main org admits it to every org. Platform-scoped records are visible only to a caller who also holds platform.audit.
- Scope `nauthera.clients:read`: Read an organization's OIDC clients through the admin API. Pairs with the clients.read permission. Distinct from nauthera.clients:register, which authorizes dynamic client registration and grants no admin authority.
- Scope `nauthera.sessions:read`: Read users' sessions through the admin API. Pairs with the sessions.read permission.
- Scope `nauthera.sessions:write`: End users' sessions through the admin API. Pairs with the sessions.revoke permission.
- Scope `nauthera.insights:read`: Read an organization's insights and alerts through the admin API. Pairs with the insights.read permission.
- Scope `nauthera.threats:read`: Read an organization's threat analytics through the admin API. Pairs with the threats.read permission.
- Scope `nauthera.roles:read`: Read who holds which role through the admin API. Pairs with the roles.read permission.
- Scope `nauthera.roles:write`: Grant and revoke roles through the admin API. Pairs with the roles.assign permission.
- Scope `nauthera.brokers:write`: Invite, accept, limit and end broker memberships through the admin API. Pairs with the brokers.manage permission.
- Scope `nauthera.domains:write`: Claim, verify and remove email domains through the admin API. Pairs with the domains.manage permission.

#### Client credentials flow

- Token URL: `https://auth.example.com/token`
- Refresh URL: `https://auth.example.com/token`
- Scope `nauthera.orgs:read`: Read organizations through the admin API (list and get). Pairs with the orgs.read permission: held in an organization, it reads that organization; listing them, and reading any other, takes a platform role held in the main org.
- Scope `nauthera.orgs:write`: Create, update and delete organizations through the admin API. Pairs with the orgs.write permission, which only a platform role held in the main org grants.
- Scope `nauthera.users:read`: Read local users through the admin API (list and get). Pairs with the users.read permission; confined to the caller's own org unless a platform role held in the main org admits it to every org.
- Scope `nauthera.users:write`: Create, update, delete, suspend, block, reactivate and unlock local users, set their passwords and email them reset links through the admin API. Pairs with the users.create, users.update, users.delete, users.lifecycle or users.credentials permission, whichever the operation declares; confined to the caller's own org unless a platform role held in the main org admits it to every org.
- Scope `nauthera.audit:read`: Read the audit log through the admin API. Pairs with the audit.read permission; confined to the caller's own org unless a platform role held in the main org admits it to every org. Platform-scoped records are visible only to a caller who also holds platform.audit.
- Scope `nauthera.clients:read`: Read an organization's OIDC clients through the admin API. Pairs with the clients.read permission. Distinct from nauthera.clients:register, which authorizes dynamic client registration and grants no admin authority.
- Scope `nauthera.sessions:read`: Read users' sessions through the admin API. Pairs with the sessions.read permission.
- Scope `nauthera.sessions:write`: End users' sessions through the admin API. Pairs with the sessions.revoke permission.
- Scope `nauthera.insights:read`: Read an organization's insights and alerts through the admin API. Pairs with the insights.read permission.
- Scope `nauthera.threats:read`: Read an organization's threat analytics through the admin API. Pairs with the threats.read permission.
- Scope `nauthera.roles:read`: Read who holds which role through the admin API. Pairs with the roles.read permission.
- Scope `nauthera.roles:write`: Grant and revoke roles through the admin API. Pairs with the roles.assign permission.
- Scope `nauthera.brokers:write`: Invite, accept, limit and end broker memberships through the admin API. Pairs with the brokers.manage permission.
- Scope `nauthera.domains:write`: Claim, verify and remove email domains through the admin API. Pairs with the domains.manage permission.

#### Permissions

- `orgs.read`: Read organizations.
- `orgs.write`: Create, update and delete organizations.
- `users.read`: Read an organization's users.
- `users.pii.read`: Read users' personal data, such as email addresses and attributes.
- `users.create`: Create users.
- `users.update`: Change a user's email address, username and attributes.
- `users.delete`: Delete users.
- `users.lifecycle`: Suspend, block, reactivate and unlock users.
- `users.credentials`: Set a user's password and manage their second factors.
- `users.activity`: Read what a user did and what was done to them.
- `sessions.read`: Read users' sessions.
- `sessions.revoke`: End users' sessions.
- `clients.read`: Read an organization's OIDC clients.
- `audit.read`: Read an organization's audit log.
- `platform.audit`: Read the platform-scoped audit records, which concern the deployment rather than any one organization, beside an organization's own.
- `insights.read`: Read an organization's insights and alerts.
- `threats.read`: Read an organization's threat analytics: the attack signals counted from its audit log, against their recommended thresholds.
- `roles.read`: Read who holds which role.
- `roles.assign`: Grant and revoke roles.
- `brokers.manage`: Invite, accept, limit and end broker memberships, which let one organization's clients sign in another's users.
- `domains.manage`: Claim, verify and remove the email domains that route a sign-in to an organization.

## Discovery

OpenID Connect discovery, AS metadata, and key material.

- [`GET /.well-known/openid-configuration` OpenID Connect discovery document](https://www.nauthera.io/docs/v1/api/discovery/get-openid-configuration.md)
- [`GET /.well-known/oauth-authorization-server` OAuth 2.0 Authorization Server Metadata (RFC 8414)](https://www.nauthera.io/docs/v1/api/discovery/get-oauth-server-metadata.md)
- [`GET /.well-known/jwks.json` JSON Web Key Set (public signing keys)](https://www.nauthera.io/docs/v1/api/discovery/get-jwks.md)

## OAuth2

OAuth2 protocol endpoints (RFC 6749, 7009, 7662, 8628, 9126).

- [`GET /authorize` OAuth2 / OIDC authorization endpoint](https://www.nauthera.io/docs/v1/api/oauth2/authorize.md)
- [`POST /authorize` OAuth2 / OIDC authorization endpoint (POST form)](https://www.nauthera.io/docs/v1/api/oauth2/authorize-post.md)
- [`POST /par` Pushed Authorization Request (RFC 9126)](https://www.nauthera.io/docs/v1/api/oauth2/pushed-authorization-request.md)
- [`POST /token` OAuth2 token endpoint](https://www.nauthera.io/docs/v1/api/oauth2/token.md)
- [`POST /device_authorization` Device Authorization Request (RFC 8628)](https://www.nauthera.io/docs/v1/api/oauth2/device-authorization.md)
- [`POST /introspect` OAuth2 token introspection (RFC 7662)](https://www.nauthera.io/docs/v1/api/oauth2/introspect.md)
- [`POST /revoke` OAuth2 token revocation (RFC 7009)](https://www.nauthera.io/docs/v1/api/oauth2/revoke.md)

## OpenID Connect

OpenID Connect protocol endpoints (OIDC Core, RP-Initiated Logout).

- [`GET /userinfo` OpenID Connect UserInfo endpoint](https://www.nauthera.io/docs/v1/api/openid-connect/get-user-info.md)
- [`POST /userinfo` OpenID Connect UserInfo endpoint (POST)](https://www.nauthera.io/docs/v1/api/openid-connect/post-user-info.md)
- [`GET /end_session` RP-Initiated Logout (OpenID Connect)](https://www.nauthera.io/docs/v1/api/openid-connect/end-session.md)
- [`POST /end_session` RP-Initiated Logout, form-encoded (RP-Initiated Logout 1.0 §2)](https://www.nauthera.io/docs/v1/api/openid-connect/end-session-post.md)
- [`GET /check_session_iframe` OP session-management iframe (OIDC Session Management 1.0 §3.2)](https://www.nauthera.io/docs/v1/api/openid-connect/check-session-iframe.md)

## Client Registration

Dynamic client registration and management (RFC 7591, 7592).

- [`POST /register` Dynamic client registration (RFC 7591)](https://www.nauthera.io/docs/v1/api/client-registration/register-client.md)
- [`GET /register/{client_id}` Read a client registration (RFC 7592)](https://www.nauthera.io/docs/v1/api/client-registration/get-client-configuration.md)
- [`PUT /register/{client_id}` Update a client registration (RFC 7592)](https://www.nauthera.io/docs/v1/api/client-registration/update-client-configuration.md)
- [`DELETE /register/{client_id}` Deprovision a client registration (RFC 7592)](https://www.nauthera.io/docs/v1/api/client-registration/delete-client-configuration.md)

## Interactive

Browser-facing endpoints backing the hosted auth UI (/ui): password sign-in, local registration, and sign-out. Same-origin JSON; not part of the OAuth2/OIDC wire protocol.

- [`POST /v1/auth/sign-in` Password sign-in (hosted auth UI)](https://www.nauthera.io/docs/v1/api/interactive/sign-in.md)
- [`POST /v1/auth/register` Local account registration (hosted auth UI)](https://www.nauthera.io/docs/v1/api/interactive/register-user.md)
- [`GET /v1/auth/captcha` The captcha the hosted UI must solve (hosted auth UI)](https://www.nauthera.io/docs/v1/api/interactive/get-captcha-challenge.md)
- [`POST /v1/auth/password-reset` Ask for a password-reset link (hosted auth UI)](https://www.nauthera.io/docs/v1/api/interactive/request-password-reset.md)
- [`POST /v1/auth/password-reset/confirm` Set a new password from a reset link (hosted auth UI)](https://www.nauthera.io/docs/v1/api/interactive/confirm-password-reset.md)
- [`POST /v1/auth/invitation/accept` Choose a password from an invitation link (hosted auth UI)](https://www.nauthera.io/docs/v1/api/interactive/accept-invitation.md)
- [`POST /v1/auth/verify-email/resend` Ask for a link that verifies an email address (hosted auth UI)](https://www.nauthera.io/docs/v1/api/interactive/request-email-verification.md)
- [`POST /v1/auth/verify-email/confirm` Verify an email address from a link (hosted auth UI)](https://www.nauthera.io/docs/v1/api/interactive/confirm-email-verification.md)
- [`POST /v1/auth/broker/route` Route an email address to the member organization that owns its domain](https://www.nauthera.io/docs/v1/api/interactive/broker-route.md)
- [`GET /v1/auth/broker/{member}/start` Begin a sign-in at a member organization of this broker](https://www.nauthera.io/docs/v1/api/interactive/broker-start.md)
- [`GET /v1/auth/broker/{member}/callback` The member organization's redirect back to this broker](https://www.nauthera.io/docs/v1/api/interactive/broker-callback.md)
- [`GET /v1/auth/federation/{slug}/start` Begin a sign-in through an identity provider](https://www.nauthera.io/docs/v1/api/interactive/federation-start.md)
- [`GET /v1/auth/federation/{slug}/callback` The identity provider's redirect back](https://www.nauthera.io/docs/v1/api/interactive/federation-callback.md)
- [`POST /v1/auth/sign-out` Sign out of the interactive session (hosted auth UI)](https://www.nauthera.io/docs/v1/api/interactive/sign-out.md)
- [`POST /v1/auth/logout/confirm` Answer an RP-initiated logout confirmation (RP-Initiated Logout 1.0 §2)](https://www.nauthera.io/docs/v1/api/interactive/confirm-logout.md)
- [`POST /v1/auth/consent` Describe the pending authorization request (OIDC Core §3.1.2.4)](https://www.nauthera.io/docs/v1/api/interactive/consent-prompt.md)
- [`POST /v1/auth/consent/decision` Record the user's consent decision (OIDC Core §3.1.2.4)](https://www.nauthera.io/docs/v1/api/interactive/decide-consent.md)
- [`POST /v1/auth/device/verify` Look up a device authorization by its user code (RFC 8628 §3.3)](https://www.nauthera.io/docs/v1/api/interactive/verify-device-user-code.md)
- [`POST /v1/auth/device/decision` Approve or deny a device authorization (RFC 8628 §3.3)](https://www.nauthera.io/docs/v1/api/interactive/decide-device-authorization.md)
- [`GET /v1/auth/mfa/totp/enroll` Begin (or re-display) TOTP enrollment](https://www.nauthera.io/docs/v1/api/interactive/begin-totp-enrollment.md)
- [`POST /v1/auth/mfa/totp/activate` Confirm and activate TOTP enrollment](https://www.nauthera.io/docs/v1/api/interactive/activate-totp-enrollment.md)
- [`POST /v1/auth/mfa/totp/recovery-ack` Acknowledge saved recovery codes and complete enrollment](https://www.nauthera.io/docs/v1/api/interactive/acknowledge-recovery-codes.md)
- [`POST /v1/auth/mfa/totp/verify` Verify a TOTP code during sign-in (step-up)](https://www.nauthera.io/docs/v1/api/interactive/verify-totp-challenge.md)
- [`POST /v1/auth/mfa/email/enroll` Send the code that enrolls the email second factor](https://www.nauthera.io/docs/v1/api/interactive/send-email-enrollment-code.md)
- [`POST /v1/auth/mfa/email/activate` Confirm and activate the email second factor](https://www.nauthera.io/docs/v1/api/interactive/activate-email-enrollment.md)
- [`POST /v1/auth/mfa/email/send` Send a sign-in code to the email second factor](https://www.nauthera.io/docs/v1/api/interactive/send-email-challenge-code.md)
- [`POST /v1/auth/mfa/email/verify` Verify an emailed code during sign-in (step-up)](https://www.nauthera.io/docs/v1/api/interactive/verify-email-challenge.md)
- [`POST /v1/auth/mfa/passkey/registration/options` Begin a passkey registration ceremony](https://www.nauthera.io/docs/v1/api/interactive/begin-passkey-registration.md)
- [`POST /v1/auth/mfa/passkey/registration/verify` Verify a passkey registration and enroll the credential](https://www.nauthera.io/docs/v1/api/interactive/verify-passkey-registration.md)
- [`POST /v1/auth/mfa/passkey/authentication/options` Begin a passkey authentication ceremony](https://www.nauthera.io/docs/v1/api/interactive/begin-passkey-authentication.md)
- [`POST /v1/auth/mfa/passkey/authentication/verify` Verify a passkey assertion during sign-in (step-up)](https://www.nauthera.io/docs/v1/api/interactive/verify-passkey-authentication.md)
- [`POST /v1/auth/mfa/passkey/offer/decline` Decline the offer to add a passkey and complete the sign-in](https://www.nauthera.io/docs/v1/api/interactive/decline-passkey-offer.md)
- [`POST /v1/auth/passkey/options` Begin a passwordless passkey sign-in](https://www.nauthera.io/docs/v1/api/interactive/passkey-sign-in-options.md)
- [`POST /v1/auth/passkey/verify` Sign in with a passkey and no password](https://www.nauthera.io/docs/v1/api/interactive/passkey-sign-in.md)
- [`POST /v1/auth/mfa/recovery-code/verify` Redeem a single-use recovery code during sign-in](https://www.nauthera.io/docs/v1/api/interactive/verify-recovery-code.md)
- [`POST /v1/auth/mfa/recovery-codes` Regenerate recovery codes](https://www.nauthera.io/docs/v1/api/interactive/regenerate-recovery-codes.md)
- [`GET /v1/auth/mfa` MFA status for the current session](https://www.nauthera.io/docs/v1/api/interactive/get-mfa-status.md)
- [`DELETE /v1/auth/mfa/totp` Disable (remove) the TOTP factor](https://www.nauthera.io/docs/v1/api/interactive/disable-totp.md)

## Admin

Privileged administrative endpoints for managing organizations (orgs) and
their local users (CRUD), versioned under `/v1/admin`. Authenticated by a
Bearer access token: every operation enforces its declared `nauthera.*`
scope (via the `oauth2` security scheme) IN ADDITION to the permission it
declares in `x-permission`, which the caller's roles must grant. Organization
endpoints are main-org only; user and audit endpoints are confined to the
caller's own org unless a platform role held in the main org admits them to
every org. All list endpoints use opaque
cursor (keyset) pagination — bound the page with `limit`, order it with
`sort` (per-endpoint `x-sort-fields`), then pass the previous response's
`page.next_cursor` back as `cursor` for as long as `page.has_more` is true.
Not part of the OAuth2/OIDC wire protocol.

- [`GET /v1/admin/me` Get who the caller is and what they may do (admin)](https://www.nauthera.io/docs/v1/api/admin/get-me.md)
- [`GET /v1/admin/problems` List what operators could not do for resources in no organization (admin)](https://www.nauthera.io/docs/v1/api/admin/list-platform-problems.md)
- [`GET /v1/admin/problems/{id}` Get one problem an operator reported for a resource in no organization (admin)](https://www.nauthera.io/docs/v1/api/admin/get-platform-problem.md)
- [`GET /v1/admin/orgs` List organizations (admin, platform staff)](https://www.nauthera.io/docs/v1/api/admin/list-organizations.md)
- [`POST /v1/admin/orgs` Create an organization (admin, main-only)](https://www.nauthera.io/docs/v1/api/admin/create-organization.md)
- [`GET /v1/admin/orgs/{slug}` Get an organization (admin)](https://www.nauthera.io/docs/v1/api/admin/get-organization.md)
- [`PATCH /v1/admin/orgs/{slug}` Update an organization (admin, main-only)](https://www.nauthera.io/docs/v1/api/admin/update-organization.md)
- [`DELETE /v1/admin/orgs/{slug}` Delete an organization (admin, main-only)](https://www.nauthera.io/docs/v1/api/admin/delete-organization.md)
- [`GET /v1/admin/orgs/{slug}/theme` Get an organization's dashboard theme (admin)](https://www.nauthera.io/docs/v1/api/admin/get-organization-theme.md)
- [`GET /v1/admin/orgs/{slug}/mail` Get an organization's email relay (admin)](https://www.nauthera.io/docs/v1/api/admin/get-organization-mail.md)
- [`POST /v1/admin/orgs/{slug}/mail/test` Send a test email through an organization's relay (admin)](https://www.nauthera.io/docs/v1/api/admin/send-organization-test-mail.md)
- [`GET /v1/admin/orgs/{slug}/snapshot` Count an organization's users, sessions and clients (admin)](https://www.nauthera.io/docs/v1/api/admin/get-organization-snapshot.md)
- [`GET /v1/admin/orgs/{slug}/clients` List an organization's OIDC clients (admin)](https://www.nauthera.io/docs/v1/api/admin/list-clients.md)
- [`GET /v1/admin/orgs/{slug}/clients/{id}` Get one OIDC client's registered configuration (admin)](https://www.nauthera.io/docs/v1/api/admin/get-client.md)
- [`GET /v1/admin/orgs/{slug}/clients/{id}/usage` Count one OIDC client's daily, monthly and all-time users (admin)](https://www.nauthera.io/docs/v1/api/admin/get-client-usage.md)
- [`GET /v1/admin/orgs/{slug}/identity-providers` List an organization's identity providers (admin)](https://www.nauthera.io/docs/v1/api/admin/get-identity-providers.md)
- [`GET /v1/admin/orgs/{slug}/problems` List what operators could not do for an organization's resources (admin)](https://www.nauthera.io/docs/v1/api/admin/list-problems.md)
- [`GET /v1/admin/orgs/{slug}/problems/{id}` Get one problem an operator reported for an organization's resource (admin)](https://www.nauthera.io/docs/v1/api/admin/get-problem.md)
- [`GET /v1/admin/orgs/{slug}/broker-memberships` List an organization's broker memberships (admin)](https://www.nauthera.io/docs/v1/api/admin/get-broker-memberships.md)
- [`POST /v1/admin/orgs/{slug}/broker-memberships` Invite an organization to be a member of this broker (admin)](https://www.nauthera.io/docs/v1/api/admin/invite-broker-member.md)
- [`DELETE /v1/admin/orgs/{slug}/broker-memberships/{id}` End a broker membership, from either side (admin)](https://www.nauthera.io/docs/v1/api/admin/end-broker-membership.md)
- [`POST /v1/admin/orgs/{slug}/broker-memberships/{id}/accept` Accept a broker's invitation (admin)](https://www.nauthera.io/docs/v1/api/admin/accept-broker-membership.md)
- [`PUT /v1/admin/orgs/{slug}/broker-memberships/{id}/clients` Choose which of the broker's clients a membership admits (admin)](https://www.nauthera.io/docs/v1/api/admin/set-broker-membership-clients.md)
- [`GET /v1/admin/orgs/{slug}/email-domains` List an organization's email domain claims (admin)](https://www.nauthera.io/docs/v1/api/admin/get-email-domains.md)
- [`POST /v1/admin/orgs/{slug}/email-domains` Claim an email domain for an organization (admin)](https://www.nauthera.io/docs/v1/api/admin/claim-email-domain.md)
- [`DELETE /v1/admin/orgs/{slug}/email-domains/{id}` Remove an email domain claim (admin)](https://www.nauthera.io/docs/v1/api/admin/remove-email-domain.md)
- [`POST /v1/admin/orgs/{slug}/email-domains/{id}/verify` Verify an email domain claim against its TXT record (admin)](https://www.nauthera.io/docs/v1/api/admin/verify-email-domain.md)
- [`GET /v1/admin/orgs/{slug}/users` List users (admin)](https://www.nauthera.io/docs/v1/api/admin/list-users.md)
- [`POST /v1/admin/orgs/{slug}/users` Create a user (admin)](https://www.nauthera.io/docs/v1/api/admin/create-user.md)
- [`GET /v1/admin/orgs/{slug}/users/{id}` Get a user (admin)](https://www.nauthera.io/docs/v1/api/admin/get-user.md)
- [`PATCH /v1/admin/orgs/{slug}/users/{id}` Update a user (admin)](https://www.nauthera.io/docs/v1/api/admin/update-user.md)
- [`DELETE /v1/admin/orgs/{slug}/users/{id}` Delete a user (admin)](https://www.nauthera.io/docs/v1/api/admin/delete-user.md)
- [`PUT /v1/admin/orgs/{slug}/users/{id}/password` Set a user's password (admin)](https://www.nauthera.io/docs/v1/api/admin/set-user-password.md)
- [`POST /v1/admin/orgs/{slug}/users/{id}/suspend` Suspend a user (admin)](https://www.nauthera.io/docs/v1/api/admin/suspend-user.md)
- [`POST /v1/admin/orgs/{slug}/users/{id}/block` Block a user (admin)](https://www.nauthera.io/docs/v1/api/admin/block-user.md)
- [`POST /v1/admin/orgs/{slug}/users/{id}/reactivate` Reactivate a user (admin)](https://www.nauthera.io/docs/v1/api/admin/reactivate-user.md)
- [`POST /v1/admin/orgs/{slug}/users/{id}/unlock` Unlock a user (admin)](https://www.nauthera.io/docs/v1/api/admin/unlock-user.md)
- [`POST /v1/admin/orgs/{slug}/users/{id}/password-change` Require a user to set a new password at their next sign-in (admin)](https://www.nauthera.io/docs/v1/api/admin/require-password-change.md)
- [`POST /v1/admin/orgs/{slug}/users/{id}/password-reset` Email a user a password reset link (admin)](https://www.nauthera.io/docs/v1/api/admin/send-user-password-reset.md)
- [`POST /v1/admin/orgs/{slug}/users/{id}/invitation` Send a user a new invitation (admin)](https://www.nauthera.io/docs/v1/api/admin/resend-user-invitation.md)
- [`GET /v1/admin/orgs/{slug}/users/{id}/devices` List a user's known browsers and networks (admin)](https://www.nauthera.io/docs/v1/api/admin/get-user-devices.md)
- [`DELETE /v1/admin/orgs/{slug}/users/{id}/devices/remembered` Forget a user's browsers remembered for their second factor (admin)](https://www.nauthera.io/docs/v1/api/admin/forget-user-remembered-browsers.md)
- [`GET /v1/admin/orgs/{slug}/users/{id}/identities` List the identity provider accounts linked to a user (admin)](https://www.nauthera.io/docs/v1/api/admin/get-user-identities.md)
- [`GET /v1/admin/orgs/{slug}/users/{id}/roles` List a user's roles (admin)](https://www.nauthera.io/docs/v1/api/admin/get-user-roles.md)
- [`PUT /v1/admin/orgs/{slug}/users/{id}/roles/{role}` Grant a user a role (admin)](https://www.nauthera.io/docs/v1/api/admin/grant-user-role.md)
- [`DELETE /v1/admin/orgs/{slug}/users/{id}/roles/{role}` Revoke a user's role (admin)](https://www.nauthera.io/docs/v1/api/admin/revoke-user-role.md)
- [`GET /v1/admin/orgs/{slug}/users/{id}/session-history` List a user's ended sessions (admin)](https://www.nauthera.io/docs/v1/api/admin/list-user-session-history.md)
- [`DELETE /v1/admin/orgs/{slug}/users/{id}/sessions` End every session of a user (admin)](https://www.nauthera.io/docs/v1/api/admin/end-user-sessions.md)
- [`GET /v1/admin/orgs/{slug}/sessions` List an organization's active sessions (admin)](https://www.nauthera.io/docs/v1/api/admin/list-sessions.md)
- [`DELETE /v1/admin/orgs/{slug}/sessions/{sid}` End one session (admin)](https://www.nauthera.io/docs/v1/api/admin/end-session.md)
- [`GET /v1/admin/orgs/{slug}/audit-events` List audit events (admin)](https://www.nauthera.io/docs/v1/api/admin/list-audit-events.md)
- [`GET /v1/admin/orgs/{slug}/audit-events/tail` Follow the audit log (admin)](https://www.nauthera.io/docs/v1/api/admin/tail-audit-events.md)
- [`GET /v1/admin/orgs/{slug}/audit-events/counts` Count audit events over time (admin)](https://www.nauthera.io/docs/v1/api/admin/count-audit-events.md)
- [`GET /v1/admin/orgs/{slug}/audit-events/top` Rank the subjects behind audit events (admin)](https://www.nauthera.io/docs/v1/api/admin/rank-audit-events.md)
- [`GET /v1/admin/orgs/{slug}/audit-events/{id}` Get an audit event (admin)](https://www.nauthera.io/docs/v1/api/admin/get-audit-event.md)
- [`GET /v1/admin/audit-catalog` Get the audit event catalog (admin)](https://www.nauthera.io/docs/v1/api/admin/get-audit-catalog.md)
- [`GET /v1/admin/orgs/{slug}/threats` Get the threat overview (admin)](https://www.nauthera.io/docs/v1/api/admin/get-threat-overview.md)
- [`GET /v1/admin/orgs/{slug}/threats/sign-ins` Get the shape of the refused sign-ins (admin)](https://www.nauthera.io/docs/v1/api/admin/get-sign-in-shape.md)
- [`GET /v1/admin/deployment/client-ip` Get how the client address is determined (admin)](https://www.nauthera.io/docs/v1/api/admin/get-client-ip-posture.md)

## About this API

- Nauthera documentation: https://www.nauthera.io/docs/v1
- Contact: Nauthera, https://www.nauthera.io/imprint
- Terms of service: https://www.nauthera.io/terms