Returns a human-readable message with some useful information about the API.

/api/v1

The user receiving this email can join the team by clicking on the link in the email. If the user does not have an account yet, they will be prompted to create one.

Send an email to invite a user to a team

Verify an email

Send a code to the user's email address for verifying the email.

Send email verification code

Check if an email verification code is valid without using it

Check email verification code

Emails

This endpoint is used to exchange an authorization code or refresh token for an access token.

OAuth token endpoints

This endpoint is used to initiate the OAuth authorization flow. there are two purposes for this endpoint: 1. Authenticate a user with an OAuth provider. 2. Link an existing user with an OAuth provider.

OAuth authorize endpoint

OAuth

No documentation available for this endpoint.

POST /team-invitations/accept/details

Others

Sign in with a code

Send a code to the user's email address for sign-in.

Send sign-in code

Complete multi-factor authorization to sign in, with a TOTP and an MFA attempt code

MFA sign in

Check if a sign in code is valid without using it

Check sign in code

Update the password of the current user, requires the old password

Update password

Create a new account with email and password

Sign up with email and password

Sign in to an account with email and password

Sign in with email and password

Send a code to the user's email address for resetting the password.

Send reset password code

Reset password with a code

Check if a reset password code is valid without using it

Check reset password code

Password

Filter with the team ID. If set, only the permissions of the members in a specific team will be returned.

Filter with the permission ID. If set, only the permissions with this specific ID will be returned

List team permissions of a user

Grant a team permission to a user (the team permission must be created first on the Stack dashboard)

Grant a team permission to a user

Revoke a team permission from a user

Permissions

Get the current project information including display name, oauth providers and authentication methods. Useful for display the available login options to the user.

Get the current project

Projects

Create a new session for a given user. This will return a refresh token that can be used to impersonate the user.

Create session

Sign out of the current session and invalidate the refresh token

Sign out of the current session

Get a new access token using a refresh token

Refresh access token

Sessions

List teams

Create a new team and optionally add the current user as a member.

Create a team

List team members profiles and filter by team ID and user ID

List team members profiles

Get a team

Delete a team

Update a team

Send an email to a user to invite them to a team

Invite a user to a team

Add a user to a team

Remove a user from a team

Get a team member profile

Update a team member profile

Check if a team invitation code is valid without using it

Check if a team invitation code is valid

Teams

List users

Creates a new user. E-mail authentication is always enabled, and no password is set, meaning the only way to authenticate the newly created user is through magic link.

Create user

Get current user

Deletes the currently authenticated user. Use this with caution.

Delete current user

Updates the currently authenticated user. Only the values provided will be updated.

Update current user

Get user

Delete user

Updates a user. Only the values provided will be updated.

Update user

Users

PostContactChannelsSendVerificationCodeResponse

PostContactChannelsVerifyCheckCodeResponse

PostContactChannelsVerifyResponse

PostTeamInvitationsSendCodeResponse

PostTeamInvitationsAcceptDetailsResponse

PostAuthMfaSignInResponse

Long-lived refresh token that can be used to obtain a new access token

Short-lived access token that can be used to authenticate the user

PostAuthOtpSendSignInCodeResponse

PostAuthOtpSignInCheckCodeResponse

PostAuthOtpSignInResponse

PostAuthPasswordResetCheckCodeResponse

PostAuthPasswordResetResponse

PostAuthPasswordSendResetCodeResponse

PostAuthPasswordSignInResponse

PostAuthPasswordSignUpResponse

PostAuthPasswordUpdateResponse

DeleteTeamPermissionsTeamIdUserIdPermissionIdResponse

GetTeamPermissionsResponse

GetTeamPermissionsResponseItemsItem

PostTeamPermissionsTeamIdUserIdPermissionIdResponse

GetProjectsCurrentResponse

Human-readable project display name. This is not a unique identifier.

GetProjectsCurrentResponseConfig

Whether email password authentication is enabled for this project

Whether magic link authentication is enabled for this project

GetProjectsCurrentResponseConfigEnabledOauthProvidersItem

DeleteAuthSessionsCurrentResponse

PostAuthSessionsCurrentRefreshResponse

PostAuthSessionsResponse

DeleteTeamMembershipsTeamIdUserIdResponse

DeleteTeamsTeamIdResponse

GetTeamMemberProfilesResponse

GetTeamMemberProfilesResponseItemsItem

URL of the profile image for team member. Can be a Base64 encoded image. Must be smaller than 100KB. Please compress and crop to a square before passing in.

GetTeamMemberProfilesResponseItemsItemUser

Whether the primary email has been verified to belong to this user

Human-readable user display name. This is not a unique identifier.

ID of the team currently selected by the user

URL of the profile image for user. Can be a Base64 encoded image. Must be smaller than 100KB. Please compress and crop to a square before passing in.

Whether the user has a password associated with their account

Client metadata. Used as a data store, accessible from the client side. Do not store information that should not be exposed to the client.

Client read-only, server-writable metadata. Used as a data store, accessible from the client side. Do not store information that should not be exposed to the client. The client can read this data, but cannot modify it. This is useful for things like subscription status.

Server metadata. Used as a data store, only accessible from the server side. You can store secret information related to the user here.

GetTeamMemberProfilesResponseItemsItemUserSelectedTeam

The time the team was created (the number of milliseconds since epoch, January 1, 1970, UTC)

Server metadata. Used as a data store, only accessible from the server side. You can store secret information related to the team here.

Human-readable team display name. This is not a unique identifier.

URL of the profile image for team. Can be a Base64 encoded image. Must be smaller than 100KB. Please compress and crop to a square before passing in.

1	curl -X POST https://api.stack-auth.com/api/v1/auth/mfa/sign-in \
2	-H "Content-Type: application/json" \
3	-d '{
4	"type": "type",
5	"totp": "totp",
6	"code": "code"
7	}'

1	{
2	"refresh_token": "i8ns3aq2...14y",
3	"access_token": "eyJhmMiJB2TO...diI4QT",
4	"is_new_user": true,
5	"user_id": "3241a285-8329-4d69-8f3d-316e08cf140c"
6	}

Request

Response