Skip to main content
Source: equa-server/modules/api/src/endpoints/auth-endpoints.ts

​
Auth Endpoints

Endpoints for user authentication, registration, password reset, email verification, two-factor authentication, and account management. Endpoint count: 19 (12 public, 7 authenticated)

​
Public Endpoints

These endpoints do not require an active session.

​
Get Current User

GET /v1/user/current
FieldValue
AuthOptional (returns null user if unauthenticated)
Request TypeEmptyRequest
Returns the current authenticated user, or an unauthenticated response if no valid session exists.

​
Get Current User (Deprecated)

GET /v1/user
Deprecated. Use GET /v1/user/current instead. This endpoint will be removed in a future API version.
FieldValue
AuthOptional (returns null user if unauthenticated)
Request TypeEmptyRequest
Legacy endpoint that returns the same response as GET /v1/user/current. Response: 
{
  "id": "uuid",
  "email": "user@example.com",
  "username": "jdoe",
  "firstName": "Jane",
  "lastName": "Doe",
  "emailVerified": true,
  "twoFactorEnabled": false
}

​
Login

POST /v1/user/login
FieldValue
AuthNone
Authenticate with email and password. Sets a session cookie on success. Request: 
{
  "email": "user@example.com",
  "password": "your-password"
}
Response: The authenticated user object.

​
Google OAuth Login

POST /v1/user/google-auth
FieldValue
AuthNone
Authenticate using a Google OAuth ID token. Creates or links a user account and establishes a session. Request: 
{
  "token": "google-id-token"
}
Response: The authenticated user object.

​
Register

POST /v1/user
FieldValue
AuthNone
Create a new user account. The registration endpoint captures the client IP via request-ip middleware and enforces the REGISTRATION_IP_LIMIT (default 20 per IP). Request: 
{
  "email": "user@example.com",
  "password": "secure-password",
  "username": "jdoe",
  "firstName": "Jane",
  "lastName": "Doe",
  "couponCode": "OPTIONAL_COUPON"
}
Response: The newly created user object.

​
Check Email Availability

POST /v1/user/email/available
FieldValue
AuthNone
Check whether an email address is available for registration. Request: 
{
  "email": "user@example.com"
}
Response: 
{
  "available": true
}

​
Check Username Availability

POST /v1/user/username/available
FieldValue
AuthNone
Check whether a username is available for registration. Request: 
{
  "username": "jdoe"
}
Response: 
{
  "available": true
}

​
Reset Password

POST /v1/user/password/reset
FieldValue
AuthNone
Send a password reset email to the specified username or email address. Request: 
{
  "usernameOrEmail": "user@example.com"
}

​
Verify Email

POST /v1/user/email/verify
FieldValue
AuthNone
Verify an email address using a verification code received via email. Request: 
{
  "code": "verification-code"
}

​
Resend Verification Email

POST /v1/user/email/verify/send
FieldValue
AuthNone
Resend the email verification message. Throttled by EMAIL_VERIFICATION_LIMIT_SECONDS (default 1800s / 30 minutes). Request: 
{
  "usernameOrEmail": "user@example.com"
}

​
Generate 2FA Secret

GET /v1/user/2fa
FieldValue
AuthNone
Generate a new TOTP two-factor authentication secret and QR code for setup.

​
Verify 2FA Token

POST /v1/user/2fa/verify
FieldValue
AuthNone
Verify a TOTP token against a 2FA secret during setup. Request: 
{
  "token": "123456",
  "secret": "base32-secret"
}

​
Authenticated Endpoints

These endpoints require an active session.

​
Enable 2FA

POST /v1/user/2fa
FieldValue
AuthRequired
Enable two-factor authentication on the authenticated user’s account after successful token verification. Request: 
{
  "token": "123456",
  "secret": "base32-secret"
}

​
Update User Profile

PATCH /v1/user
FieldValue
AuthRequired
Update the current user’s profile information. Request: 
{
  "firstName": "Jane",
  "lastName": "Doe",
  "username": "janedoe"
}

​
List Users

GET /v1/users
FieldValue
AuthRequired
PermissioncanReadSite
List all users (site admin only).

​
Logout

POST /v1/user/logout
FieldValue
AuthRequired
Destroy the current session and clear the session cookie.

​
Get User Coupon

GET /v1/user/coupon
FieldValue
AuthRequired
Get coupon information for the authenticated user.

​
Update User Account

PATCH /v1/user/:user/account
FieldValue
AuthRequired
Update account-level settings for the specified user.

​
Get User Account

GET /v1/user/:user/account
FieldValue
AuthRequired
Retrieve account-level details for the specified user.