API Reference

All API endpoints require authentication unless otherwise noted. The Legacy API uses HMAC (System Account) authentication. OAuth endpoints use standard OAuth flows. Management API endpoints require HMAC authentication from an administrator's system account.

Authentication

User login, logout, registration, and password management. Base path: /legacy/api/Authentication

POST /legacy/api/Authentication/User/Login/{appId?} Authenticate user (email + password)

POST /legacy/api/Authentication/User/Logout/{everywhere?} Invalidate session(s)

POST /legacy/api/Authentication/User/Register Register new user

GET /legacy/api/Authentication/User/Register/Complete/{key} Complete email verification

POST /legacy/api/Authentication/User/Roaming/Register Register user from another org

POST /legacy/api/Authentication/User/{email}/PasswordReset Request password reset

POST /legacy/api/Authentication/Organisation/{publicId}/Register/Account Register user in specific org

GET /legacy/api/Authentication/Action/{id}/{type} Complete authentication action

GET /legacy/api/Authentication/Action/{id}/{type}/Requirement Check action requirement

GET /legacy/api/Authentication/Account/VerifyIdentity/{key?} Verify user identity

Users

User profile and session management. Base path: /legacy/api/User

GET /legacy/api/User/Profile/{appId}/{key}/{extendSetting?} Get user profile by session key

GET /legacy/api/User/{userId}/OrionSessions List active sessions for user

GET /legacy/api/User/Username/Available/{username} Check username availability

Keys

Session key validation and conversion. Base path: /legacy/api/Keys

GET /legacy/api/Keys/User/{key} Validate session key

POST /legacy/api/Keys/User/{key}/Convert/To/UserTemp Convert to temporary key

POST /legacy/api/Keys/User/{key}/Convert/To/UserPerm Convert to permanent key

GET /legacy/api/Keys/User/{key}/Permission/{appId} Check key permission for app

Organisations

Organisation and application listing. Base path: /legacy/api/Organisation

GET /legacy/api/Organisation/Application/List List apps in caller's org

GET /legacy/api/Organisation/External/Application/List List all accessible apps

GET /legacy/api/Organisations/{appId}/{publicId}/application/list List apps by org ID

OAuth 2.0 / OIDC Endpoints

All OAuth endpoints are scoped per organisation via the {orgPublicId} path segment.

Discovery & Keys

OpenID Connect discovery and key material

GET /oauth/{org}/.well-known/openid-configuration OIDC Discovery document

GET /oauth/{org}/.well-known/jwks.json JSON Web Key Set

Authorization & Token

Core OAuth 2.0 token flow endpoints

GET /oauth/{org}/authorize Authorization endpoint (start flow)

POST /oauth/{org}/authorize Process consent decision

POST /oauth/{org}/login Process login form submission

POST /oauth/{org}/twofactor Process 2FA challenge

POST /oauth/{org}/token Token endpoint (exchange code/refresh)

POST /oauth/{org}/revoke Revoke a token

POST /oauth/{org}/introspect Token introspection

User & Session

User information and session management

GET /oauth/{org}/userinfo Get authenticated user info

GET /oauth/{org}/end_session End session / logout

Device Authorization

OAuth 2.0 Device Authorization Grant (RFC 8628)

POST /oauth/{org}/device Request device code

GET /oauth/{org}/device/verify Device verification page

POST /oauth/{org}/device/verify Submit device verification

Consent

User consent management

GET /oauth/{org}/consent Consent screen

GET /oauth/{org}/user/consents List user's granted consents

POST /oauth/{org}/user/consents/{id}/revoke Revoke a consent

Management API (OAuth Administration)

These endpoints are for programmatic OAuth client management. Requires HMAC authentication from an organisation administrator's system account.

Client Management

CRUD operations for OAuth clients. Base path: /legacy/api/oauth/clients

GET /legacy/api/oauth/clients List all OAuth clients

GET /legacy/api/oauth/clients/{clientId} Get client details

POST /legacy/api/oauth/clients Create new OAuth client

PUT /legacy/api/oauth/clients/{clientId} Update client settings

DELETE /legacy/api/oauth/clients/{clientId} Delete an OAuth client

POST /legacy/api/oauth/clients/{clientId}/rotate-secret Rotate client secret

POST /legacy/api/oauth/clients/{clientId}/revoke-old-secret Revoke previous secret

Scope Management

Custom OAuth scope CRUD. Base path: /legacy/api/oauth/scopes

GET /legacy/api/oauth/scopes List all custom scopes

POST /legacy/api/oauth/scopes Create new scope

PUT /legacy/api/oauth/scopes/{id} Update scope

DELETE /legacy/api/oauth/scopes/{id} Delete scope

Consent & Pre-Authorization Management

Manage consents and pre-authorizations programmatically

GET /legacy/api/oauth/consents List all consents

POST /legacy/api/oauth/consents/organisation Grant org-wide consent

POST /legacy/api/oauth/consents/user Grant user-level consent

DELETE /legacy/api/oauth/consents/{id} Revoke consent

GET /legacy/api/oauth/preauthorizations List pre-authorizations

POST /legacy/api/oauth/preauthorizations Create pre-authorization

DELETE /legacy/api/oauth/preauthorizations/{id} Delete pre-authorization

Management UI (Admin Views)

Browser-accessible management pages. Require federation authentication + admin role.

GET /oauth/manage/{org}/scopes Scope management UI

GET /oauth/manage/{org}/consents Consent management UI

GET /oauth/manage/{org}/quickstart OAuth quick start guide

Sovereign Signing Endpoints

Out-of-band JWT signing by external agents. Agent endpoints require Bearer <agent-api-key> authentication.

Pool Discovery & Keys

Pool-specific OIDC discovery and key material (agent keys only — no server keys)

GET /oauth/{org}/sovereign/pools/{poolId}/.well-known/openid-configuration Pool-specific OIDC discovery document

GET /oauth/{org}/sovereign/pools/{poolId}/jwks.json Pool JWKS — serves only agent public keys (with optional x5c cert chains)

Agent API

Endpoints for signing agents to poll, claim, sign, challenge, or reject requests

GET /oauth/{org}/sovereign/agent/queue Poll for pending signing requests in the agent's pool

POST /oauth/{org}/sovereign/agent/claim Claim the next pending signing request

POST /oauth/{org}/sovereign/agent/sign Submit signed JWT for a claimed request

POST /oauth/{org}/sovereign/agent/challenge Issue a user-facing challenge before signing

POST /oauth/{org}/sovereign/agent/reject Reject a claimed request (with reason)

User Wait

Endpoints for the browser wait page during sovereign signing

GET /oauth/{org}/sovereign/wait/{requestId}/stream SSE stream — real-time status updates (signed, challenge, failed, expired)

GET /oauth/{org}/sovereign/wait/{requestId}/status Polling fallback — JSON status of a signing request

POST /oauth/{org}/sovereign/wait/{requestId}/respond Submit user response to an agent-issued challenge

Admin

Manage sovereign signing pools and agents

POST /oauth/{org}/sovereign/admin/pools Create a signing pool

POST /oauth/{org}/sovereign/admin/agents Register an agent (returns API key — shown once)

DELETE /oauth/{org}/sovereign/admin/agents/{agentId} Deactivate an agent

Device Identity Endpoints

Certificate-based device enrollment and authentication. See the Device Identity Guide for the full flow.

Enrollment

Enroll a device with a one-time code and CSR to receive an Orion-issued device certificate

POST /oauth/{org}/devices/enroll Standard enrollment (code + CSR → cert)

POST /oauth/{org}/devices/enroll/begin TPM enrollment step 1 (EK cert + AK pub → credential blob challenge)

POST /oauth/{org}/devices/enroll/complete TPM enrollment step 2 (attestation evidence + CSR → cert)

GET /oauth/{org}/devices/ca.pem Org device CA certificate (public)

Admin

Manage device registrations (requires admin session)

GET /devices/manage/{org} List registered devices + register form

POST /devices/manage/{org}/register Generate enrollment code (shown once)

POST /devices/manage/{org}/{id}/revoke Revoke a device certificate (immediate)