API reference
Every endpoint, grouped by area and generated from Limen's OpenAPI spec (version 0.0.0). Tenant-scoped routes live under /v1/{tenantSlug}. All errors share the same envelope.
Prefer to try requests in-browser? The interactive Swagger UI is served straight from the API.
Tenants
Create a workspace and its first admin.
post
/v1/tenantsCreate a tenant
Request body (required)
| tenantrequired | object |
| adminrequired | object |
Responses
200OK
Body
| userrequired | object |
| accessTokenrequired | string |
| refreshTokenrequired | string |
| accessTokenExpiresInrequired | integer |
| refreshTokenExpiresInrequired | integer |
| tenantSlugrequired | string |
400Bad request
409Conflict
429Too many requests
Authentication
Sign up, sign in, refresh, and sign out.
post
/v1/{tenantSlug}/auth/loginLog in
Path parameters
| tenantSlugrequired | string length 1–∞ |
Request body (required)
| emailrequired | string (email) length 0–254 |
| passwordrequired | string length 1–1024 |
| totpCode | string pattern ^\d{6}$ |
| emailOtpCode | string pattern ^\d{6}$ |
Responses
200OK
Body
| userrequired | object |
| accessTokenrequired | string |
| refreshTokenrequired | string |
| accessTokenExpiresInrequired | integer |
| refreshTokenExpiresInrequired | integer |
401Unauthorized
404Not found
429Too many requests
post
/v1/{tenantSlug}/auth/logoutLog out
Path parameters
| tenantSlugrequired | string length 1–∞ |
Request body (required)
| refreshTokenrequired | string length 1–1024 |
Responses
200OK
Body
| okrequired | true |
404Not found
post
/v1/{tenantSlug}/auth/logout-allLog out everywhere
Path parameters
| tenantSlugrequired | string length 1–∞ |
Responses
200OK
Body
| okrequired | true |
| countrequired | integer |
401Unauthorized
404Not found
post
/v1/{tenantSlug}/auth/refreshRefresh a session
Path parameters
| tenantSlugrequired | string length 1–∞ |
Request body (required)
| refreshTokenrequired | string length 1–1024 |
Responses
200OK
Body
| userrequired | object |
| accessTokenrequired | string |
| refreshTokenrequired | string |
| accessTokenExpiresInrequired | integer |
| refreshTokenExpiresInrequired | integer |
401Unauthorized
404Not found
429Too many requests
post
/v1/{tenantSlug}/auth/request-email-otpRequest an email code
Path parameters
| tenantSlugrequired | string length 1–∞ |
Request body (required)
| emailrequired | string (email) length 0–254 |
| passwordrequired | string length 1–1024 |
Responses
200OK
Body
| okrequired | true |
401Unauthorized
404Not found
429Too many requests
post
/v1/{tenantSlug}/auth/signupSign up
Path parameters
| tenantSlugrequired | string length 1–∞ |
Request body (required)
| emailrequired | string (email) length 0–254 |
| passwordrequired | string length 12–1024 |
Responses
200OK
Body
| userrequired | object |
| accessTokenrequired | string |
| refreshTokenrequired | string |
| accessTokenExpiresInrequired | integer |
| refreshTokenExpiresInrequired | integer |
400Bad request
404Not found
429Too many requests
post
/v1/{tenantSlug}/auth/totp/initial-enrollBegin TOTP enrollment
Path parameters
| tenantSlugrequired | string length 1–∞ |
Request body (required)
| emailrequired | string (email) length 0–254 |
| passwordrequired | string length 1–1024 |
Responses
200OK
Body
| secretrequired | string |
| otpauthUrirequired | string |
401Unauthorized
403Forbidden
404Not found
409Conflict
429Too many requests
post
/v1/{tenantSlug}/auth/totp/initial-verifyVerify initial TOTP
Path parameters
| tenantSlugrequired | string length 1–∞ |
Request body (required)
| emailrequired | string (email) length 0–254 |
| passwordrequired | string length 1–1024 |
| coderequired | string pattern ^\d{6}$ |
Responses
200OK
Body
| userrequired | object |
| accessTokenrequired | string |
| refreshTokenrequired | string |
| accessTokenExpiresInrequired | integer |
| refreshTokenExpiresInrequired | integer |
401Unauthorized
403Forbidden
404Not found
409Conflict
429Too many requests
MFA
Enrol and manage second factors.
post
/v1/{tenantSlug}/mfa/totp/enrollPOST /v1/{tenantSlug}/mfa/totp/enroll
Path parameters
| tenantSlugrequired | string length 1–∞ |
Responses
200OK
Body
| secretrequired | string |
| otpauthUrirequired | string |
401Unauthorized
404Not found
post
/v1/{tenantSlug}/mfa/totp/verifyPOST /v1/{tenantSlug}/mfa/totp/verify
Path parameters
| tenantSlugrequired | string length 1–∞ |
Request body (required)
| coderequired | string pattern ^\d{6}$ |
Responses
200OK
Body
| okrequired | true |
401Unauthorized
404Not found
Google OAuth
The hosted Google sign-in flow.
get
/v1/{tenantSlug}/oauth/google/callbackGoogle callback
Path parameters
| tenantSlugrequired | string length 1–∞ |
Query parameters
| code | string length 1–∞ |
| state | string length 1–∞ |
| error | string length 1–∞ |
| error_description | string |
Responses
200OK
Body
| userrequired | object |
| accessTokenrequired | string |
| refreshTokenrequired | string |
| accessTokenExpiresInrequired | integer |
| refreshTokenExpiresInrequired | integer |
400Bad request
401Unauthorized
404Not found
429Too many requests
get
/v1/{tenantSlug}/oauth/google/startStart Google sign-in
Path parameters
| tenantSlugrequired | string length 1–∞ |
Responses
200OK
Body
| authorizationUrlrequired | string (uri) |
400Bad request
404Not found
Current user
Operate on the authenticated user.
get
/v1/{tenantSlug}/meGet the current user
Path parameters
| tenantSlugrequired | string length 1–∞ |
Responses
200OK
Body
| idrequired | string |
| tenantIdrequired | string |
| emailrequired | string (email) |
| statusrequired | "Pending" | "Active" | "Suspended" |
| rolerequired | "Member" | "Admin" |
| createdAtrequired | string (date-time) |
| lastLoginAtrequired | string (date-time) |
| tenantrequired | object |
| totpEnrolledrequired | boolean |
401Unauthorized
404Not found
delete
/v1/{tenantSlug}/meDelete the current user
Path parameters
| tenantSlugrequired | string length 1–∞ |
Responses
200OK
Body
| okrequired | true |
401Unauthorized
404Not found
patch
/v1/{tenantSlug}/me/passwordPATCH /v1/{tenantSlug}/me/password
Path parameters
| tenantSlugrequired | string length 1–∞ |
Request body (required)
| currentPasswordrequired | string length 1–1024 |
| newPasswordrequired | string length 12–1024 |
Responses
200OK
Body
| okrequired | true |
400Bad request
401Unauthorized
404Not found
Invites
post
/v1/invites/acceptPOST /v1/invites/accept
Request body (required)
| tokenrequired | string length 1–1024 |
| passwordrequired | string length 12–1024 |
Responses
200OK
Body
| userrequired | object |
| accessTokenrequired | string |
| refreshTokenrequired | string |
| accessTokenExpiresInrequired | integer |
| refreshTokenExpiresInrequired | integer |
| tenantSlugrequired | string |
400Bad request
401Unauthorized
409Conflict
429Too many requests
Admin
Tenant administration.
get
/v1/{tenantSlug}/api-keysGET /v1/{tenantSlug}/api-keys
Path parameters
| tenantSlugrequired | string length 1–∞ |
Query parameters
| includeRevoked | boolean |
Responses
200OK
Body
| itemsrequired | object[] |
401Unauthorized
403Forbidden
404Not found
429Too many requests
post
/v1/{tenantSlug}/api-keysPOST /v1/{tenantSlug}/api-keys
Path parameters
| tenantSlugrequired | string length 1–∞ |
Request body (required)
| namerequired | string length 1–120 |
| environmentrequired | "live" | "test" |
| expiresAt | string (date-time) |
Responses
200OK
Body
| plaintextrequired | string |
| apiKeyrequired | object |
401Unauthorized
403Forbidden
404Not found
429Too many requests
delete
/v1/{tenantSlug}/api-keys/{id}DELETE /v1/{tenantSlug}/api-keys/{id}
Path parameters
| tenantSlugrequired | string length 1–∞ |
| idrequired | string length 1–∞ |
Responses
200OK
Body
| okrequired | true |
401Unauthorized
403Forbidden
404Not found
429Too many requests
get
/v1/{tenantSlug}/auditList audit events
Path parameters
| tenantSlugrequired | string length 1–∞ |
Query parameters
| action | "UserSignup" | "UserLogin" | "UserLoginFailed" | "UserLogout" | "UserPasswordChanged" | "UserEmailVerified" | "UserSoftDeleted" | "UserHardDeleted" | "MfaTotpEnrolled" | "MfaTotpDisabled" | "MfaTotpVerified" | "MfaEmailOtpSent" | "MfaEmailOtpVerified" | "MfaEmailOtpFailed" | "InviteCreated" | "InviteAccepted" | "InviteRevoked" | "InviteExpired" | "ApiKeyCreated" | "ApiKeyRevoked" | "SessionCreated" | "SessionRevoked" | "SessionFamilyCompromised" | "TenantCreated" | "TenantUpdated" | "TenantSoftDeleted" | "GdprExportRequested" | "GdprExportCompleted" | "GdprErasureRequested" | "GdprErasureCompleted" | "GoogleOauthLinked" | "GoogleOauthUnlinked" |
| userId | string (uuid) |
| before | string (date-time) |
| limit | integer |
| search | string length 1–200 |
Responses
200OK
Body
| itemsrequired | object[] |
401Unauthorized
403Forbidden
404Not found
429Too many requests
get
/v1/{tenantSlug}/invitesGET /v1/{tenantSlug}/invites
Path parameters
| tenantSlugrequired | string length 1–∞ |
Query parameters
| includeAccepted | boolean |
| includeRevoked | boolean |
Responses
200OK
Body
| itemsrequired | object[] |
401Unauthorized
403Forbidden
404Not found
429Too many requests
post
/v1/{tenantSlug}/invitesPOST /v1/{tenantSlug}/invites
Path parameters
| tenantSlugrequired | string length 1–∞ |
Request body (required)
| emailrequired | string (email) length 0–254 |
| role | "Member" | "Admin" |
| ttlSeconds | integer |
Responses
200OK
Body
| tokenrequired | string |
| inviterequired | object |
401Unauthorized
403Forbidden
404Not found
429Too many requests
delete
/v1/{tenantSlug}/invites/{id}DELETE /v1/{tenantSlug}/invites/{id}
Path parameters
| tenantSlugrequired | string length 1–∞ |
| idrequired | string length 1–∞ |
Responses
200OK
Body
| okrequired | true |
401Unauthorized
403Forbidden
404Not found
429Too many requests
put
/v1/{tenantSlug}/oauth/google/credentialsPUT /v1/{tenantSlug}/oauth/google/credentials
Path parameters
| tenantSlugrequired | string length 1–∞ |
Request body (required)
| clientIdrequired | string length 1–512 |
| clientSecretrequired | string length 1–512 |
Responses
200OK
Body
| okrequired | true |
401Unauthorized
403Forbidden
404Not found
429Too many requests
delete
/v1/{tenantSlug}/oauth/google/credentialsDELETE /v1/{tenantSlug}/oauth/google/credentials
Path parameters
| tenantSlugrequired | string length 1–∞ |
Responses
200OK
Body
| okrequired | true |
401Unauthorized
403Forbidden
404Not found
429Too many requests
get
/v1/{tenantSlug}/tenantGET /v1/{tenantSlug}/tenant
Path parameters
| tenantSlugrequired | string length 1–∞ |
Responses
200OK
Body
| idrequired | string |
| slugrequired | string |
| namerequired | string |
| planrequired | "Free" | "Starter" | "Growth" | "Enterprise" |
| mfaPolicyrequired | "Disabled" | "Optional" | "Required" |
| googleOauthEnabledrequired | boolean |
| googleClientIdrequired | string |
| hasGoogleClientSecretrequired | boolean |
| createdAtrequired | string (date-time) |
401Unauthorized
403Forbidden
404Not found
429Too many requests
patch
/v1/{tenantSlug}/tenantPATCH /v1/{tenantSlug}/tenant
Path parameters
| tenantSlugrequired | string length 1–∞ |
Request body (required)
| name | string length 1–120 |
| mfaPolicy | "Disabled" | "Optional" | "Required" |
Responses
200OK
Body
| idrequired | string |
| slugrequired | string |
| namerequired | string |
| planrequired | "Free" | "Starter" | "Growth" | "Enterprise" |
| mfaPolicyrequired | "Disabled" | "Optional" | "Required" |
| googleOauthEnabledrequired | boolean |
| googleClientIdrequired | string |
| hasGoogleClientSecretrequired | boolean |
| createdAtrequired | string (date-time) |
400Bad request
401Unauthorized
403Forbidden
404Not found
429Too many requests
get
/v1/{tenantSlug}/usersGET /v1/{tenantSlug}/users
Path parameters
| tenantSlugrequired | string length 1–∞ |
Responses
200OK
Body
| itemsrequired | object[] |
401Unauthorized
403Forbidden
404Not found
429Too many requests
delete
/v1/{tenantSlug}/users/{userId}DELETE /v1/{tenantSlug}/users/{userId}
Path parameters
| tenantSlugrequired | string length 1–∞ |
| userIdrequired | string (uuid) |
Responses
200OK
Body
| okrequired | true |
401Unauthorized
403Forbidden
404Not found
429Too many requests
post
/v1/{tenantSlug}/users/{userId}/totp/disablePOST /v1/{tenantSlug}/users/{userId}/totp/disable
Path parameters
| tenantSlugrequired | string length 1–∞ |
| userIdrequired | string length 1–∞ |
Responses
200OK
Body
| okrequired | true |
401Unauthorized
403Forbidden
404Not found
429Too many requests
Service
Liveness, readiness, and the spec itself.
get
/healthLiveness
Responses
200OK
get
/readyReadiness
Responses
200OK
get
/v1/openapi.jsonOpenAPI document
Responses
200OK