Evenbead docs
Contents

Sign in

19 operations. All areas

POST/v1/auth/passkey/challenge

Start signing in with a passkey: a single-use challenge (5 minutes) for navigator.credentials.get() with userVerification required. No credential (a sign-in step); rate-limited per address. Not an MCP tool.

  • Operation startPasskeySignIn
  • Scope: none (public)
  • Write: sets a value, no Idempotency-Key needed
Request body

Empty object {}.

Responses
  • 200 Challenge (object)
  • Errors 400, 401, 409, 422, 429, 500, 503 (Error: error.type, message)

POST/v1/auth/passkey/sign-in

Finish signing in with a passkey: the assertion over our challenge (origin and relying party checked, user verified, signature counter forward). Opens a session; a passkey is two factors. No credential (a sign-in step); rate-limited per address. Not an MCP tool.

  • Operation finishPasskeySignIn
  • Scope: none (public)
  • Write: sets a value, no Idempotency-Key needed
Request body
  • credential object, required
Responses
  • 201 Signed in (SignedIn)
  • Errors 400, 401, 409, 422, 429, 500, 503 (Error: error.type, message)

POST/v1/auth/email-links/code

Sign in with the 6-digit code from a sign-in email, in the browser that asked for it (someone reading the email on a phone signs in on the computer). The code belongs to the link: it works once, within the same 15 minutes, and using either spends both. Five wrong codes lock this request's codes (the link still works). Refusals say why in `error.details.outcome`: wrong_code (with `attempts_left`), locked, expired, used, replaced or invalid. No credential (a sign-in step); rate-limited per address. Not an MCP tool.

  • Operation redeemEmailCode
  • Scope: none (public)
  • Write: sets a value, no Idempotency-Key needed
Request body
  • browser string, required A random value the browser keeps in an HttpOnly cookie for this sign-in (the web app sets it). A sign-in link opened with the same value signs in at once; with another value (another browser or device) it signs in only after the person confirms whose account it is. The email's code and second-step tickets work only with the same value.
  • code string, required The 6 digits from the email
Responses
  • 200 A second step is needed (SecondStep)
  • 201 Signed in (SignedIn)
  • Errors 400, 401, 409, 422, 429, 500, 503 (Error: error.type, message)

POST/v1/auth/second-factor/status

The second step of a sign-in: whose it is and which factors work (nothing if the ticket is unknown, used, expired or from another browser). No credential (a sign-in step); rate-limited per address. Not an MCP tool.

  • Operation getSecondFactor
  • Scope: none (public)
  • Read
Request body
  • ticket string, required
  • browser string, required A random value the browser keeps in an HttpOnly cookie for this sign-in (the web app sets it). A sign-in link opened with the same value signs in at once; with another value (another browser or device) it signs in only after the person confirms whose account it is. The email's code and second-step tickets work only with the same value.
Responses
  • 200 The pending second step (object)
  • Errors 400, 401, 409, 422, 429, 500, 503 (Error: error.type, message)

POST/v1/auth/second-factor

Finish a sign-in with the authenticator app's code or a recovery code (each recovery code works once). Five wrong codes end the ticket. No credential (a sign-in step); rate-limited per address. Not an MCP tool.

  • Operation finishSecondFactor
  • Scope: none (public)
  • Write: sets a value, no Idempotency-Key needed
Request body
  • ticket string, required
  • browser string, required A random value the browser keeps in an HttpOnly cookie for this sign-in (the web app sets it). A sign-in link opened with the same value signs in at once; with another value (another browser or device) it signs in only after the person confirms whose account it is. The email's code and second-step tickets work only with the same value.
  • totp_code string The 6-digit code from the authenticator app
  • recovery_code string One of the person's one-time recovery codes (spaces and dashes ignored)
Responses
  • 201 Signed in (SignedIn)
  • Errors 400, 401, 409, 422, 429, 500, 503 (Error: error.type, message)

GET/v1/me/security

Your sign-in settings: email address, passkeys, authenticator app, recovery codes, whether your company requires two-step sign-in, this session. A person's own browser session only (ebs_ or ebf_); API keys, agents and AI apps are refused. Not an MCP tool.

  • Operation getMySecurity
  • Scope: none
  • Read
Responses
  • 200 Your security settings (object)
  • Errors 400, 401, 403, 429, 500 (Error: error.type, message)

POST/v1/me/step-up/challenge

Start confirming it's you (a step-up): a single-use challenge (5 minutes; at most 5 an hour) for navigator.credentials.get() with your passkeys, or the ticket for an authenticator or recovery code. Sensitive changes in a browser session (keys, payment settings, exports, passkeys and two-step, owner invitations, AI apps that post, crypto wallets, billing) need a step-up within the last 10 minutes; signing in counts as one. A person's own browser session only (ebs_ or ebf_); API keys, agents and AI apps are refused. Not an MCP tool.

  • Operation startStepUp
  • Scope: none
  • Write: sets a value, no Idempotency-Key needed
Request body

Empty object {}.

Responses
  • 200 Challenge (object)
  • Errors 400, 401, 403, 409, 422, 429, 500 (Error: error.type, message)

POST/v1/me/step-up

Confirm it's you: a passkey assertion over the step-up challenge, or the challenge with an authenticator code or a recovery code (each works once). Five wrong tries end the challenge. A person's own browser session only (ebs_ or ebf_); API keys, agents and AI apps are refused. Not an MCP tool.

  • Operation finishStepUp
  • Scope: none
  • Write: sets a value, no Idempotency-Key needed
Request body
  • challenge string
  • credential object
  • totp_code string The 6-digit code from the authenticator app
  • recovery_code string One of the person's one-time recovery codes (spaces and dashes ignored)
Responses
  • 200 Confirmed for 10 minutes (object)
  • Errors 400, 401, 403, 409, 422, 429, 500 (Error: error.type, message)

POST/v1/me/passkeys/challenge

Start adding a passkey: the options for navigator.credentials.create() (a discoverable credential, user verification required, attestation none). A person's own browser session only (ebs_ or ebf_); API keys, agents and AI apps are refused. Not an MCP tool.

  • Operation startPasskeyEnrollment
  • Scope: none
  • Write: sets a value, no Idempotency-Key needed
Request body

Empty object {}.

Responses
  • 200 Creation options (object)
  • Errors 400, 401, 403, 409, 422, 429, 500 (Error: error.type, message)

POST/v1/me/passkeys

Add a passkey: the registration response to our challenge (origin, relying party, user verification checked). The first second factor also creates your recovery codes, shown once. A person's own browser session only (ebs_ or ebf_); API keys, agents and AI apps are refused. Not an MCP tool.

  • Operation addPasskey
  • Scope: none
  • Write: sets a value, no Idempotency-Key needed
Request body
  • credential object, required
  • name string
Responses
  • 201 Added (object)
  • Errors 400, 401, 403, 409, 422, 429, 500 (Error: error.type, message)

POST/v1/me/passkeys/{id}/remove

Remove one of your passkeys (not the last second factor while your company requires two-step sign-in). A person's own browser session only (ebs_ or ebf_); API keys, agents and AI apps are refused. Not an MCP tool.

  • Operation removePasskey
  • Scope: none
  • Write: sets a value, no Idempotency-Key needed
Parameters
  • id path, string, required
Request body
  • reason string
Responses
  • 200 Removed (object)
  • Errors 400, 401, 403, 404, 409, 422, 429, 500 (Error: error.type, message)

POST/v1/me/totp

Start setting up an authenticator app: a new secret (shown once, as text and an otpauth:// URI for a QR code). Confirm it with a first code. A person's own browser session only (ebs_ or ebf_); API keys, agents and AI apps are refused. Not an MCP tool.

  • Operation startTotp
  • Scope: none
  • Write: sets a value, no Idempotency-Key needed
Request body

Empty object {}.

Responses
  • 200 The secret (object)
  • Errors 400, 401, 403, 409, 422, 429, 500 (Error: error.type, message)

POST/v1/me/totp/confirm

Turn the authenticator app on with its current code. The first second factor also creates your recovery codes, shown once. A person's own browser session only (ebs_ or ebf_); API keys, agents and AI apps are refused. Not an MCP tool.

  • Operation confirmTotp
  • Scope: none
  • Write: sets a value, no Idempotency-Key needed
Request body
  • code string, required The 6-digit code from the authenticator app
Responses
  • 200 On (object)
  • Errors 400, 401, 403, 409, 422, 429, 500 (Error: error.type, message)

POST/v1/me/totp/disable

Turn the authenticator app off, with a current code (not the last second factor while your company requires two-step sign-in). A person's own browser session only (ebs_ or ebf_); API keys, agents and AI apps are refused. Not an MCP tool.

  • Operation disableTotp
  • Scope: none
  • Write: sets a value, no Idempotency-Key needed
Request body
  • code string, required The 6-digit code from the authenticator app
Responses
  • 200 Off (object)
  • Errors 400, 401, 403, 409, 422, 429, 500 (Error: error.type, message)

POST/v1/me/recovery-codes

New recovery codes (10, shown once); the unused old ones stop working. Needs a passkey or an authenticator app. A person's own browser session only (ebs_ or ebf_); API keys, agents and AI apps are refused. Not an MCP tool.

  • Operation regenerateRecoveryCodes
  • Scope: none
  • Write: sets a value, no Idempotency-Key needed
Request body

Empty object {}.

Responses
  • 200 New codes (object)
  • Errors 400, 401, 403, 409, 422, 429, 500 (Error: error.type, message)

POST/v1/me/sessions/revoke-others

Sign out every other device: revokes all of your other sessions at once (this one stays). A person's own browser session only (ebs_ or ebf_); API keys, agents and AI apps are refused. Not an MCP tool.

  • Operation revokeOtherSessions
  • Scope: none
  • Write: sets a value, no Idempotency-Key needed
Request body
  • reason string
Responses
  • 200 Signed out (object)
  • Errors 400, 401, 403, 409, 422, 429, 500 (Error: error.type, message)

POST/v1/me/email

Set your email address (unverified until you use the link we send to it), or resend the verification link (omit email). A person's own browser session only (ebs_ or ebf_); API keys, agents and AI apps are refused. Not an MCP tool.

  • Operation setMyEmail
  • Scope: none
  • Write: sets a value, no Idempotency-Key needed
Request body
  • email string An email address
Responses
  • 200 Sent, or already verified (object)
  • Errors 400, 401, 403, 409, 422, 429, 500 (Error: error.type, message)