Authentication
Refresh Token
Refreshes the authentication token. Does not require Bearer token as the current token is used from the request context.
Get Profile
Returns the authenticated user's profile information along with a top-level `is_production_server` flag indicating whether the server is running in production (used by the SPA to gate sandbox-environment UI affordances).
Update Profile
Updates the authenticated user's profile (name and email).
Update Password
Updates the authenticated user's password. Sends a confirmation email upon success.
Get Alerts
Returns paginated alerts for the authenticated user.
Get Unread Notifications
Returns paginated unread UI notifications for the authenticated user. Only returns alerts with show_in_ui_notification=1 that have not been read.
Mark Notification as Read
Marks a specific notification as read for the authenticated user.
Sign Out of All Sessions (Global Logout)
Signs the authenticated user out of every browser and device — across every subdomain and every pod.
Log In
Authenticate an active buyer with email and password and receive a bearer token. `email` and `password` are required; `remember` (optional, default false) keeps the session longer-lived. Wrong credentials and inactive accounts both return a generic 401 with no indication of which failed.
Request Login Code
Send a 6-digit one-time sign-in code to the buyer's email. Always returns a generic success message so the response never reveals whether an account exists. Rate limited.
Verify Login Code
Exchange a valid 6-digit email code for a bearer token. `email` and `code` are required. Invalid or expired codes return a 422 validation error.
Accept Invitation
Set a password from a single-use, time-limited invitation token (delivered by email when a merchant invites a buyer) and activate the account. Returns a bearer token so the buyer is signed in immediately. `token`, `password`, and a matching `password_confirmation` are required. Expired or already-used tokens return a 422 validation error.
Request Password Reset
Email a password-reset link to an active buyer. Always returns a generic success message regardless of whether the account exists. Rate limited.
Reset Password
Set a new password using the token from a reset email. `token`, `password`, and a matching `password_confirmation` are required. Expired or invalid tokens return a 422 validation error.
Start SSO Sign-In
Begin a company SSO (SAML/OIDC) sign-in for the given company. Returns 501 when SSO is not configured for the account.
Complete SSO Sign-In
Handle the SSO provider callback for the given company. Returns 501 when SSO is not configured for the account.
Log Out
Revoke the current bearer token. Requires authentication.