Skip to main content

Authentication

Every API request is authenticated and resolved against a specific tenant and user identity.

TODO

This page is a stub. Document the authentication model end to end:

  • API keys — how they are created (POST /system/{tenant}/apiKeys, POST /system/{tenant}/userProfiles/{userProfileId}/apiKeys), the header or scheme used to present them, their scope, and how they are revoked (DELETE /system/{tenant}/apiKeys/{id}).
  • Interactive / user sessions — if there is a separate flow for logged-in users (accounts, signup) versus machine-to-machine API keys.
  • Authorization — how user profiles, roles, or permissions restrict what an authenticated caller can read and write.
  • Tenant resolution — how the authenticated identity is tied to the {tenant} path segment.