Aller au contenu
Documentation TimeTonic

Overview

Timetonic Authentication Service API 1.0.0

Section intitulée « Timetonic Authentication Service API 1.0.0 »

REST API for authentication, 2FA, password management, and SAML SSO.

Authentication

Protected endpoints require a JWT access token:

Authorization: Bearer <access_token>

Rate Limiting

Requests are rate limited. See individual endpoint descriptions for limits.

Note: recent portal features (WebAuthn, profile/avatar, company management, invitations, privacy, admin) are not yet specified here — see routes/api.php. Sync pending.

Information

  • OpenAPI version: 3.1.0

Operations

Section intitulée « Operations »
GET
/health
POST
/auth/logout
POST
/auth/refresh
GET
/auth/me
POST
/password/forgot
GET
/password/check-reset-token
POST
/password/reset
POST
/password/change
GET
/2fa/status
POST
/2fa/setup
POST
/2fa/confirm
POST
/2fa/disable
POST
/2fa/backup-codes
GET
/sessions
POST
/sessions/revoke-others
DELETE
/sessions/{sessionId}
GET
/saml/{tenant}/metadata
GET
/saml/{tenant}/info
GET
/saml/{tenant}/login
POST
/saml/{tenant}/acs
GET
/saml/{tenant}/sls
GET
/.well-known/openid-configuration
GET
/.well-known/jwks.json
GET
/oidc/authorize
POST
/oidc/authorize
POST
/oidc/token
GET
/oidc/userinfo
POST
/oidc/introspect
POST
/oidc/revoke
GET
/oidc/logout
GET
/bootstrap
GET
/keepalive
POST
/identify
POST
/login
POST
/login/2fa/setup/confirm
POST
/signup/initialize
POST
/signup/user
POST
/signup/finalize
GET
/portal/{companyCodeContext}/bootstrap
POST
/portal/{companyCodeContext}/identify
POST
/portal/{companyCodeContext}/login
POST
/portal/{companyCodeContext}/login/2fa/setup/confirm
POST
/admin/accounts/{code}/users

Authentication

Section intitulée « Authentication »

bearerAuth

Section intitulée « bearerAuth »

Security scheme type: http

Bearer format: JWT

sessionCookieAuth

Section intitulée « sessionCookieAuth »

Portal session cookie (Laravel session driver), accepted alongside bearerAuth by routes using the OidcBearerOrSession middleware. Session auth also requires the CSRF header (X-CSRF-TOKEN / XSRF-TOKEN) on state-changing requests.

Security scheme type: apiKey

Cookie parameter name: laravel_session

serviceKey

Section intitulée « serviceKey »

Pre-shared service-to-service API key (SANDBOX_MANAGER_SERVICE_KEY env var)

Security scheme type: http