Authentication
All paths are relative to the base path /api/v1 (same origin as the UI). Authentication, roles, pagination and the error format are described in the overview; the types are on the page Data types.
| Operation | Request | Permission |
|---|---|---|
| Login options (public) | GET /auth/config | public |
| Start the OIDC authorization code flow (PKCE) - browser redirect | GET /auth/login | public |
| OIDC redirect URI - creates the session and redirects to the UI | GET /auth/callback | public |
| Local login (only when auth.devLogin.enabled, i.e. dev mode) | POST /auth/dev-login | public |
| Break-glass sign-in of the bootstrap admin (only while auth.bootstrapAdmin is active) | POST /auth/bootstrap-login | public |
| End the session | POST /auth/logout | read (viewer) |
| Current principal with effective permissions | GET /auth/me | read (viewer) |
Login options (public)
GET /api/v1/auth/config
Operation getAuthConfig. Permission public. No login is needed.
Responses
| Status | Description | Content type | Type |
|---|---|---|---|
| 200 | Login options | application/json | AuthConfigInfo |
Start the OIDC authorization code flow (PKCE) - browser redirect
GET /api/v1/auth/login
Operation startOidcLogin. Permission public. No login is needed.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
redirect | query | string | no | UI path to return to after login (must start with “/”). Default /. |
Responses
| Status | Description | Content type | Type |
|---|---|---|---|
| 302 | Redirect to the identity provider | - | - |
| 404 | Not found (code not_found) | application/problem+json | Problem |
OIDC redirect URI - creates the session and redirects to the UI
GET /api/v1/auth/callback
Operation oidcCallback. Permission public. No login is needed.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
code | query | string | yes | |
state | query | string | yes |
Responses
| Status | Description | Content type | Type |
|---|---|---|---|
| 302 | Redirect to the UI (session and CSRF cookies set). On failure the redirect goes to /login?error=access_denied (no role mapped for the user) or /login?error=oidc_error. | - | - |
| 401 | Not authenticated (code unauthorized) | application/problem+json | Problem |
Local login (only when auth.devLogin.enabled, i.e. dev mode)
POST /api/v1/auth/dev-login
Operation devLogin. Permission public. No login is needed.
Request body
Content type application/json, required. Type: DevLoginRequest.
{
"username": "string",
"password": "string"
}
Responses
| Status | Description | Content type | Type |
|---|---|---|---|
| 200 | Logged in; session and CSRF cookies set | application/json | Me |
| 401 | Not authenticated (code unauthorized) | application/problem+json | Problem |
| 404 | Not found (code not_found) | application/problem+json | Problem |
| 429 | Too many login attempts for this client address or user name (code too_many_requests, header Retry-After) | application/problem+json | Problem |
Break-glass sign-in of the bootstrap admin (only while auth.bootstrapAdmin is active)
POST /api/v1/auth/bootstrap-login
Operation bootstrapLogin. Permission public. No login is needed.
Request body
Content type application/json, required. Type: BootstrapLoginRequest.
{
"username": "string",
"password": "string",
"token": "string"
}
Responses
| Status | Description | Content type | Type |
|---|---|---|---|
| 200 | Signed in; session and CSRF cookies set | application/json | Me |
| 400 | Invalid request (code bad_request) | application/problem+json | Problem |
| 401 | Not authenticated (code unauthorized) | application/problem+json | Problem |
| 404 | Not found (code not_found) | application/problem+json | Problem |
| 429 | Too many sign-in attempts for this client address or for the bootstrap admin (code too_many_requests, header Retry-After) | application/problem+json | Problem |
End the session
POST /api/v1/auth/logout
Operation logout. Permission read (lowest role: viewer).
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-CSRF-Token | header | string | no | Required for cookie-authenticated mutating requests (value of cookie myriarch_csrf). |
Responses
| Status | Description | Content type | Type |
|---|---|---|---|
| 204 | Logged out | - | - |
| 401 | Not authenticated (code unauthorized) | application/problem+json | Problem |
Current principal with effective permissions
GET /api/v1/auth/me
Operation getMe. Permission read (lowest role: viewer).
Responses
| Status | Description | Content type | Type |
|---|---|---|---|
| 200 | Current principal | application/json | Me |
| 401 | Not authenticated (code unauthorized) | application/problem+json | Problem |