Auth
Signing in through your identity provider, and the keys that let a client verify a token.
Begin sign-in
Redirects to your identity provider to authenticate. The platform never handles a password itself — identity is always asserted by the provider. Public.
Complete sign-in
The address your identity provider returns to after authenticating. Exchanges the provider's code for a platform token. A user signing in for the first time is added to every tenant whose groups they belong to. Public.
Exchange credentials for a token
Issues a platform token for a user your identity provider recognises. Intended for machine-to-machine callers and test harnesses; people sign in through the browser flow above. Public.
Refresh a token
Not implemented. Tokens are re-obtained by signing in again. Public.
Sign out
Ends the calling session. The credential stops being accepted immediately rather than at its natural expiry. Safe to call when already signed out.
Get the token signing keys
Returns the public keys used to sign platform tokens, so a service can verify a token without calling the platform. Public.
List the tenants you can sign in to
Returns the tenants this identity belongs to. Only the caller's own tenants are ever listed — the platform's tenant list cannot be enumerated this way.
Choose a tenant
Completes sign-in by issuing a token scoped to one tenant, for an identity that belongs to several. Requesting a tenant you do not belong to is refused identically to one that does not exist, so membership cannot be probed.