Reference
View as MarkdownMe API
Current principal.
14 operations. Every call needs a session cookie or an Authorization: Bearer nct_… token unless marked Public. Conventions, errors and scopes
/meThe authenticated user and principal
Response 200 · OK · application/json
- createdAtstring (date-time)required
- emailstringrequired
- idstringrequired
- instanceAdminbooleanrequiredThe first user: manages instance settings
- namestringrequired
- PrincipalBodyrequired
- workspaceIdstringrequired
401Unauthorized500Internal Server Error
Errors are RFC 9457 application/problem+json with a stable code field.
/meUpdate the signed-in user's profile
Request body · application/json · required
- namestringrequired
Response 200 · OK · application/json
- createdAtstring (date-time)required
- emailstringrequired
- idstringrequired
- instanceAdminbooleanrequiredThe first user: manages instance settings
- namestringrequired
- PrincipalBodyrequired
- workspaceIdstringrequired
401Unauthorized403Forbidden422Unprocessable Entity500Internal Server Error
Errors are RFC 9457 application/problem+json with a stable code field.
/me/2fa/disableTurn 2FA off (needs a code, and the password when the account has one)
Request body · application/json · required
- codestringrequiredA current authenticator code or a recovery code
- passwordstringRequired when the account has a password
Response 204 · No Content
No body.
401Unauthorized403Forbidden409Conflict422Unprocessable Entity500Internal Server Error
Errors are RFC 9457 application/problem+json with a stable code field.
/me/2fa/enableConfirm the authenticator and turn 2FA on
Returns the 10 single-use recovery codes once. This session counts as second-factor verified afterwards.
Request body · application/json · required
- codestringrequired
Response 200 · OK · application/json
- recoveryCodesstring[] | nullrequiredSingle-use codes; shown once
401Unauthorized403Forbidden409Conflict422Unprocessable Entity500Internal Server Error
Errors are RFC 9457 application/problem+json with a stable code field.
/me/2fa/recovery-codesReplace the recovery codes (needs a current code)
Invalidates every previous code and returns 10 new ones, shown once.
Request body · application/json · required
- codestringA current authenticator code or an unused recovery code
- passwordstringInstead of a code, for an account that uses passkeys and no authenticator app
Response 200 · OK · application/json
- recoveryCodesstring[] | nullrequiredSingle-use codes; shown once
401Unauthorized403Forbidden409Conflict422Unprocessable Entity500Internal Server Error
Errors are RFC 9457 application/problem+json with a stable code field.
/me/2fa/setupGenerate a TOTP secret to add to an authenticator app
Replaces any unconfirmed secret. Confirm it with POST /me/2fa/enable. Returns 409 when 2FA is already on.
Response 200 · OK · application/json
- secretstringrequiredBase32 secret for manual entry
- uristringrequiredotpauth:// URI for authenticator apps
401Unauthorized403Forbidden409Conflict500Internal Server Error
Errors are RFC 9457 application/problem+json with a stable code field.
/me/identities/{id}Unlink a single-sign-on account
| Parameter | In | Type | Description |
|---|---|---|---|
idrequired | path | string |
Response 204 · No Content
No body.
401Unauthorized403Forbidden404Not Found409Conflict422Unprocessable Entity500Internal Server Error
Errors are RFC 9457 application/problem+json with a stable code field.
/me/passkeysThe signed-in user's passkeys
Response 200 · OK · application/json
- PasskeyBody[] | nullrequired
401Unauthorized403Forbidden500Internal Server Error
Errors are RFC 9457 application/problem+json with a stable code field.
/me/passkeysFinish adding a passkey
Counts as a second factor for the team 2FA requirement. When the account has no unused recovery code left, a fresh set is issued and returned once.
Request body · application/json · required
- credentialanyrequiredThe RegistrationResponseJSON of the authenticator (PublicKeyCredential.toJSON())
- namestringrequiredWhat to call this passkey, for example 'MacBook' or 'YubiKey'
Response 201 · Created · application/json
- PasskeyBodyrequired
- recoveryCodesstring[] | nullIssued when the account had no unused recovery code left; single use, shown once
401Unauthorized403Forbidden409Conflict422Unprocessable Entity500Internal Server Error
Errors are RFC 9457 application/problem+json with a stable code field.
/me/passkeys/{id}Rename a passkey
| Parameter | In | Type | Description |
|---|---|---|---|
idrequired | path | string |
Request body · application/json · required
- namestringrequired
Response 204 · No Content
No body.
401Unauthorized403Forbidden404Not Found422Unprocessable Entity500Internal Server Error
Errors are RFC 9457 application/problem+json with a stable code field.
/me/passkeys/{id}Remove a passkey (needs the password when the account has one)
Fails with 409 last_sign_in_method when it is the account's only way to sign in.
| Parameter | In | Type | Description |
|---|---|---|---|
idrequired | path | string |
Request body · application/json · required
- passwordstringRequired when the account has a password
Response 204 · No Content
No body.
401Unauthorized403Forbidden404Not Found409Conflictlast_sign_in_method422Unprocessable Entity500Internal Server Error
Errors are RFC 9457 application/problem+json with a stable code field.
/me/passkeys/optionsStart adding a passkey
Returns the WebAuthn creation options for navigator.credentials.create; the answer goes to POST /me/passkeys. Needs the password again when the account has one. Passkeys are discoverable credentials with user verification required.
Request body · application/json · required
- passwordstringRequired when the account has a password
Response 200 · OK · application/json
401Unauthorized403Forbidden409Conflict422Unprocessable Entity500Internal Server Error
Errors are RFC 9457 application/problem+json with a stable code field.
/me/passwordChange the signed-in user's password
Request body · application/json · required
- currentPasswordstringrequired
- newPasswordstringrequired
Response 204 · No Content
No body.
401Unauthorized403Forbidden422Unprocessable Entity500Internal Server Error
Errors are RFC 9457 application/problem+json with a stable code field.
/me/securityTwo-factor and linked-account status of the signed-in user
Response 200 · OK · application/json
- enrollmentNeededbooleanrequiredThe current team requires 2FA and this account has not enrolled; everything else is blocked until it does
- hasPasswordbooleanrequired
- IdentityBody[] | nullrequired
- isInstanceAdminbooleanrequired
- PasskeyBody[] | nullrequired
- passkeysUnavailablestringWhy passkeys cannot be used at this address (it needs HTTPS and a domain name); absent when they can
- recoveryCodesLeftinteger (int64)required
- RequiredTeamBody[] | nullrequired
- sessionMfabooleanrequiredThis session proved a second factor
- totpEnabledbooleanrequired
- totpPendingbooleanrequiredA secret was generated but not confirmed yet
401Unauthorized403Forbidden500Internal Server Error
Errors are RFC 9457 application/problem+json with a stable code field.