The whole method-settings object — { signIn, registration } — keyed by authentication kind, then by method. Reach for this when configuring a deployment; reach for the two halves when rendering one screen.

Read every method setting

GET /api/auth/authentication/method admin

Both halves as stored.

Returns

{ signIn, registration }.

Request

curl https://example.com/api/auth/authentication/method \
  -H "authorization: Bearer $TOKEN"

Response

{
  "signIn": {
    "username": { "passphrase": true, "credential": true },
    "email": { "passphrase": true, "verification": true, "code": true }
  },
  "registration": {
    "username": { "passphrase": true },
    "email": { "verification": true }
  }
}

Merge a change into the method settings

POST /api/auth/authentication/method admin

A patch across either half. Keys absent from the body keep the values they had.

Parameters

signIn object

The sign-in half, keyed by authentication kind.

registration object

The registration half, keyed by authentication kind.

Returns

Both halves after the merge.

Request

curl -X POST https://example.com/api/auth/authentication/method \
  -H "authorization: Bearer $TOKEN" \
  -H "content-type: application/json" \
  -d '{ "signIn": { "username": { "credential": true } } }'

Response

{
  "signIn": { "username": { "passphrase": true, "credential": true } },
  "registration": { "username": { "passphrase": true } }
}

Replace the method settings

PUT /api/auth/authentication/method admin

Wholesale replacement of both halves. Anything not in the body is gone.

Parameters

signIn object

The complete sign-in half.

registration object

The complete registration half.

Returns

The settings as written.

Request

curl -X PUT https://example.com/api/auth/authentication/method \
  -H "authorization: Bearer $TOKEN" \
  -H "content-type: application/json" \
  -d '{ "signIn": { "username": { "passphrase": true } }, "registration": {} }'

Response

{
  "signIn": { "username": { "passphrase": true } },
  "registration": {}
}

Reset every method setting

DELETE /api/auth/authentication/method admin

Back to the framework defaults, both halves.

Returns

The settings after the reset.

Request

curl -X DELETE https://example.com/api/auth/authentication/method \
  -H "authorization: Bearer $TOKEN"

Response

{
  "signIn": { "username": { "passphrase": true } },
  "registration": { "username": { "passphrase": true } }
}

Which authentication methods the deployment offers for signing in. Keyed by authentication kind, then by method — { "username": { "passphrase": true, "credential": true } }. A client that reports "method unavailable" is reporting this, not a bug in itself.

Read the sign-in methods

GET /api/auth/signin/method admin

The settings as stored. Safe to render a form from.

Returns

The signIn half of the method settings.

Request

curl https://example.com/api/auth/signin/method \
  -H "authorization: Bearer $TOKEN"

Response

{
  "username": { "passphrase": true, "credential": true },
  "email": { "passphrase": true, "verification": true, "code": true },
  "phone": { "code": true }
}

Merge a change into the sign-in methods

POST /api/auth/signin/method admin

A patch. Keys absent from the body keep the values they had.

Parameters

<kind> object

One entry per authentication kind — email, phone, username — holding the methods to enable or disable.

1 nested field

<method> boolean

Whether that method is offered.

Returns

The signIn settings after the merge.

Request

curl -X POST https://example.com/api/auth/signin/method \
  -H "authorization: Bearer $TOKEN" \
  -H "content-type: application/json" \
  -d '{ "username": { "credential": true } }'

Response

{
  "username": { "passphrase": true, "credential": true }
}

Replace the sign-in methods

PUT /api/auth/signin/method admin

Wholesale replacement. Anything not in the body is gone — which is the difference from POST, and the reason to reach for this only when writing the whole settings object.

Parameters

<kind> object

The complete settings, replacing what was stored.

Returns

The signIn settings as written.

Request

curl -X PUT https://example.com/api/auth/signin/method \
  -H "authorization: Bearer $TOKEN" \
  -H "content-type: application/json" \
  -d '{ "username": { "passphrase": true } }'

Response

{
  "username": { "passphrase": true }
}

Reset the sign-in methods

DELETE /api/auth/signin/method admin

Back to the framework defaults.

Returns

The signIn settings after the reset.

Request

curl -X DELETE https://example.com/api/auth/signin/method \
  -H "authorization: Bearer $TOKEN"

Response

{
  "username": { "passphrase": true },
  "email": { "passphrase": true, "verification": true }
}

Which authentication methods the deployment offers for registering. Keyed by authentication kind, then by method — { "username": { "passphrase": true, "credential": true } }. A client that reports "method unavailable" is reporting this, not a bug in itself.

Read the registration methods

GET /api/auth/register/method admin

The settings as stored. Safe to render a form from.

Returns

The registration half of the method settings.

Request

curl https://example.com/api/auth/register/method \
  -H "authorization: Bearer $TOKEN"

Response

{
  "username": { "passphrase": true, "credential": true },
  "email": { "passphrase": true, "verification": true, "code": true },
  "phone": { "code": true }
}

Merge a change into the registration methods

POST /api/auth/register/method admin

A patch. Keys absent from the body keep the values they had.

Parameters

<kind> object

One entry per authentication kind — email, phone, username — holding the methods to enable or disable.

1 nested field

<method> boolean

Whether that method is offered.

Returns

The registration settings after the merge.

Request

curl -X POST https://example.com/api/auth/register/method \
  -H "authorization: Bearer $TOKEN" \
  -H "content-type: application/json" \
  -d '{ "username": { "credential": true } }'

Response

{
  "username": { "passphrase": true, "credential": true }
}

Replace the registration methods

PUT /api/auth/register/method admin

Wholesale replacement. Anything not in the body is gone — which is the difference from POST, and the reason to reach for this only when writing the whole settings object.

Parameters

<kind> object

The complete settings, replacing what was stored.

Returns

The registration settings as written.

Request

curl -X PUT https://example.com/api/auth/register/method \
  -H "authorization: Bearer $TOKEN" \
  -H "content-type: application/json" \
  -d '{ "username": { "passphrase": true } }'

Response

{
  "username": { "passphrase": true }
}

Reset the registration methods

DELETE /api/auth/register/method admin

Back to the framework defaults.

Returns

The registration settings after the reset.

Request

curl -X DELETE https://example.com/api/auth/register/method \
  -H "authorization: Bearer $TOKEN"

Response

{
  "username": { "passphrase": true },
  "email": { "passphrase": true, "verification": true }
}