Auth

Auth

18 endpoints in this module.

/api-keys

Method	Path	Auth	Permissions	Roles	Description
GET	/api/api-keys	jwt	SETTINGS_WRITE	—	List all API keys for the current tenant
GET	/api/api-keys/:id	jwt	SETTINGS_WRITE	—	Get a specific API key by ID
POST	/api/api-keys	jwt	SETTINGS_WRITE	—	Create a new API key (returns full key once)
PATCH	/api/api-keys/:id	jwt	SETTINGS_WRITE	—	Update API key name, scopes, or expiry
POST	/api/api-keys/:id/rotate	jwt	SETTINGS_WRITE	—	Rotate an API key (old key revoked, new key returned once)
POST	/api/api-keys/:id/revoke	jwt	SETTINGS_WRITE	—	Revoke an API key (marks as REVOKED, cannot be used)
DELETE	/api/api-keys/:id	jwt	SETTINGS_WRITE	—	Delete an API key permanently

_{Source: apps/api/src/modules/auth/api-key.controller.ts}

/auth

Method	Path	Auth	Permissions	Roles	Description
POST	/api/auth/login	public	—	—	Login with email and password
POST	/api/auth/refresh	public	—	—	Refresh access token
POST	/api/auth/logout	public	—	—	Logout and invalidate session
POST	/api/auth/forgot-password	public	—	—	Request a password reset link by email (self-service)
POST	/api/auth/reset-password	public	—	—	Reset password with a valid reset token (self-service)
POST	/api/auth/mfa/setup	jwt	—	—	Generate TOTP secret and QR code for MFA setup
GET	/api/auth/mfa/status	jwt	—	—	Check MFA status for the current user
POST	/api/auth/mfa/verify	jwt	—	—	Verify TOTP code and enable MFA
POST	/api/auth/mfa/disable	jwt	—	—	Disable MFA with TOTP confirmation
POST	/api/auth/mfa/recovery-codes	jwt	—	—	Regenerate MFA recovery codes (requires valid TOTP code)
POST	/api/auth/change-password	jwt	—	—	Change password (requires current password)

_{Source: apps/api/src/modules/auth/auth.controller.ts}