Download OpenAPI specification:
Authentication microservice — user registration, login, JWT tokens, account management, email flows
Creates an organization/account and its initial admin user.
| accountName required | string [ 3 .. 100 ] characters Account/organization name |
| website | string <uri> Account website URL |
| address | string [ 10 .. 500 ] characters Mailing address |
| licensePlan | string Enum: "STARTER" "BUSINESS" "ENTERPRISE" License plan tier |
| billingType | string Enum: "MONTHLY" "ANNUAL" "TRIAL" "FREE" Billing cadence/type |
| serviceTypes | Array of strings [ 1 .. 3 ] items Items Enum: "COACHING" "MENTORING" "FACILITATION" Services included in the account subscription |
| maxUsers | integer [ 1 .. 10000 ] Maximum number of seats/users allowed on this account |
| adminName required | string [ 3 .. 100 ] characters Initial admin user's full name |
| adminEmail required | string <email> Initial admin user's email (unique, lowercased server-side) |
| adminRole required | string Enum: "ADMIN" "GROUP_ADMIN" Role assigned to the initial admin user |
| ssoDomain | string SSO email domain for the account |
| isDefaultAccount | boolean Whether this is the platform's default account |
{- "accountName": "Acme Corp",
- "address": "123 Main St, Springfield, IL 62701",
- "licensePlan": "BUSINESS",
- "billingType": "ANNUAL",
- "serviceTypes": [
- "COACHING"
], - "maxUsers": 100,
- "adminName": "Jane Doe",
- "adminEmail": "admin@example.com",
- "adminRole": "ADMIN",
- "ssoDomain": "example.com",
- "isDefaultAccount": false
}{- "result": "SUCCESS",
- "message": "Operation succeeded",
- "data": { }
}Updates account fields and (optionally) admin name.
| id required | string <uuid> Example: 550e8400-e29b-41d4-a716-446655440000 Account ID |
| accountName | string [ 3 .. 100 ] characters Account/organization name |
| website | string <uri> Account website URL |
| address | string Mailing address |
| licensePlan | string Enum: "STARTER" "BUSINESS" "ENTERPRISE" License plan tier |
| billingType | string Enum: "MONTHLY" "ANNUAL" "TRIAL" "FREE" Billing cadence/type |
| serviceTypes | Array of strings Items Enum: "COACHING" "MENTORING" "FACILITATION" Services included in the account subscription |
| maxUsers | integer Maximum number of seats/users allowed on this account |
| isDefaultAccount | boolean Whether this is the platform's default account |
| status | string Enum: "ACTIVE" "INACTIVE" Resource status |
| adminName | string Initial admin user's full name |
{- "accountName": "Acme Corp",
- "address": "123 Main St, Springfield, IL 62701",
- "licensePlan": "BUSINESS",
- "billingType": "ANNUAL",
- "serviceTypes": [
- "COACHING"
], - "maxUsers": 100,
- "isDefaultAccount": false,
- "status": "ACTIVE",
- "adminName": "Jane Doe"
}{- "result": "SUCCESS",
- "message": "Operation succeeded",
- "data": { }
}Returns a single account by ID.
| id required | string <uuid> Example: 550e8400-e29b-41d4-a716-446655440000 Resource UUID |
{- "result": "SUCCESS",
- "message": "Operation succeeded",
- "data": { }
}Verifies a user email using the activation token.
| token required | string Activation token sent via email |
{- "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.token.value"
}{- "result": "SUCCESS",
- "message": "Operation succeeded",
- "data": { }
}Issues a new access token using a valid refresh token.
| refreshToken required | string [ 1 .. 1000 ] characters Long-lived refresh token used to mint a new accessToken |
{- "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyIn0.refresh"
}{- "result": "SUCCESS",
- "message": "Operation succeeded",
- "data": { }
}Completes account setup after OAuth verification using a pre-verified temp token.
| provider required | string Enum: "google" "outlook" "azure-ad" "microsoft" Example: google OAuth provider identifier |
| tempToken required | string Email verification token (hex string) |
| verifiedEmail required | string <email> Verified email |
object User | |
object Account | |
object Profile | |
| code | string Machine-readable error code |
| state | string State |
| scope | string Scope |
| error | string Error |
| error_description | string Error description |
{- "tempToken": "string",
- "verifiedEmail": "user@example.com",
- "user": { },
- "account": { },
- "profile": { },
- "code": "ERROR_CODE",
- "state": "string",
- "scope": "string",
- "error": "string",
- "error_description": "string"
}{- "result": "SUCCESS",
- "message": "Operation succeeded",
- "data": { }
}Signs in an existing user via OAuth callback payload.
| provider required | string Enum: "google" "outlook" "azure-ad" "microsoft" Example: google OAuth provider identifier |
object User | |
object Account | |
object Profile | |
| code | string Machine-readable error code |
| state | string State |
| scope | string Scope |
| error | string Error |
| error_description | string Error description |
{- "user": { },
- "account": { },
- "profile": { },
- "code": "ERROR_CODE",
- "state": "string",
- "scope": "string",
- "error": "string",
- "error_description": "string"
}{- "result": "SUCCESS",
- "message": "Operation succeeded",
- "data": { }
}Creates an account from an invitation link via OAuth.
| provider required | string Enum: "google" "outlook" "azure-ad" "microsoft" Example: google OAuth provider identifier |
| invitationToken required | string Mandatory invitation token |
object User | |
object Account | |
object Profile | |
| code | string Machine-readable error code |
| state | string State |
| scope | string Scope |
{- "invitationToken": "i_8f3c1b6a9d4e2f17",
- "user": { },
- "account": { },
- "profile": { },
- "code": "ERROR_CODE",
- "state": "string",
- "scope": "string"
}{- "result": "SUCCESS",
- "message": "Operation succeeded",
- "data": { }
}Authenticates a user and returns access + refresh tokens.
| email required | string <email> <= 255 characters User email address (unique, lowercased server-side) |
| password required | string <password> non-empty User password — plaintext at API boundary, bcrypt-hashed (rounds=12 per BCRYPT_ROUNDS env) before storage |
| rememberMe | boolean Default: false If true, mints a longer-lived refresh token |
{- "email": "user@example.com",
- "password": "Pa$$w0rd123",
- "rememberMe": false
}{- "result": "SUCCESS",
- "message": "Operation succeeded",
- "data": { }
}Sends a password reset link to the supplied email.
| email required | string <email> <= 255 characters User email address (unique, lowercased server-side) |
{- "email": "user@example.com"
}{- "result": "SUCCESS",
- "message": "Operation succeeded",
- "data": { }
}Resets the user's password using a reset token.
| token required | string [ 1 .. 1000 ] characters Opaque or JWT token (context-specific) |
| newPassword required | string <password> >= 8 characters Must contain upper, lower, digit, special char |
{- "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.token.value",
- "newPassword": "Pa$$w0rd123"
}{- "result": "SUCCESS",
- "message": "Operation succeeded",
- "data": { }
}Validates an access or refresh token; used by legacy services.
| token required | string [ 1 .. 2000 ] characters Opaque or JWT token (context-specific) |
| tokenType | string Default: "access" Enum: "access" "refresh" Token type |
{- "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.token.value",
- "tokenType": "access"
}{- "result": "SUCCESS",
- "message": "Operation succeeded",
- "data": { }
}Public endpoint hit by AWS SNS to deliver SES Bounce / Complaint / Delivery notifications and the initial SubscriptionConfirmation. No bearer auth — relies on SNS signature verification.
Raw SNS message body (parsed as text/plain regardless of Content-Type).
{- "result": "SUCCESS",
- "message": "Operation succeeded",
- "data": { }
}Sets the password for a previously invited / verified user.
| email required | string <email> <= 255 characters User email address (unique, lowercased server-side) |
| password required | string <password> >= 8 characters User password — plaintext at API boundary, bcrypt-hashed (rounds=12 per BCRYPT_ROUNDS env) before storage |
| token required | string non-empty Opaque or JWT token (context-specific) |
{- "email": "user@example.com",
- "password": "Pa$$w0rd123",
- "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.token.value"
}{- "result": "SUCCESS",
- "message": "Operation succeeded",
- "data": { }
}Creates a new user under an account.
| email required | string <email> <= 255 characters User email address (unique, lowercased server-side) |
| role required | string Enum: "COACH" "ADMIN" "COACHEE" "ASSOCIATE" "MANAGER" "SPONSOR" "GROUP_ADMIN" User role; gates access to role-specific endpoints |
| accountId required | integer >= 1 Account ID (numeric) |
| name | string [ 3 .. 100 ] characters Display name |
| createdBy | integer or null ID of the user who created this resource |
| programId | integer Program ID (numeric) |
| skipEmail | boolean Default: false If true, suppresses the invitation email send |
{- "email": "user@example.com",
- "role": "COACH",
- "accountId": 1,
- "name": "Jane Doe",
- "createdBy": 1,
- "programId": 0,
- "skipEmail": false
}{- "result": "SUCCESS",
- "message": "Operation succeeded",
- "data": { }
}Creates up to 100 users in one call.
required | Array of objects [ 1 .. 100 ] items Users |
| filename | string [ 1 .. 255 ] characters Filename |
{- "users": [ ],
- "filename": "string"
}{- "result": "SUCCESS",
- "message": "Operation succeeded",
- "data": { }
}Creates users without filename; name auto-derived from email.
required | Array of objects [ 1 .. 100 ] items Users |
{- "users": [ ]
}{- "result": "SUCCESS",
- "message": "Operation succeeded",
- "data": { }
}Updates user details, role, activation status, or role operation.
| id required | string <uuid> Example: 550e8400-e29b-41d4-a716-446655440000 Resource UUID |
string <email> User email address (unique, lowercased server-side) | |
| role | string Enum: "SUPER_ADMIN" "COACH" "ADMIN" "COACHEE" "ASSOCIATE" "MANAGER" "SPONSOR" "GROUP_ADMIN" User role; gates access to role-specific endpoints |
| accountId | integer Account ID (numeric) |
| activationStatus | string Enum: "PENDING_EMAIL_VERIFICATION" "PENDING_ACCOUNT_CREATION" "INVITED" "ACTIVE" "INACTIVE" Activation status |
| name | string Display name |
| emailVerified | string or null <date-time> Email verified |
| activeRoleName | string Enum: "SUPER_ADMIN" "COACH" "ADMIN" "COACHEE" "ASSOCIATE" "MANAGER" "SPONSOR" "GROUP_ADMIN" Active role name |
| roleOperation | string Enum: "ACTIVATE_ROLE" "DEACTIVATE_ROLE" "REMOVE_ROLE" Role operation |
{- "email": "user@example.com",
- "role": "SUPER_ADMIN",
- "accountId": 0,
- "activationStatus": "PENDING_EMAIL_VERIFICATION",
- "name": "Jane Doe",
- "emailVerified": "string",
- "activeRoleName": "SUPER_ADMIN",
- "roleOperation": "ACTIVATE_ROLE"
}{- "result": "SUCCESS",
- "message": "Operation succeeded",
- "data": { }
}Admin-only update of user name and roles.
| id required | string <uuid> Example: 550e8400-e29b-41d4-a716-446655440000 Resource UUID |
| name | string [ 3 .. 100 ] characters Display name |
| roles | Array of strings non-empty Items Enum: "COACH" "ADMIN" "COACHEE" "ASSOCIATE" "MANAGER" "SPONSOR" "GROUP_ADMIN" List of user roles |
| accountId required | integer >= 1 Account ID (numeric) |
{- "name": "Jane Doe",
- "roles": [
- "coach"
], - "accountId": 1
}{- "result": "SUCCESS",
- "message": "Operation succeeded",
- "data": { }
}Deletes a user or removes a specific role from their account.
| id required | string <uuid> Example: 550e8400-e29b-41d4-a716-446655440000 Resource UUID |
| accountId required | integer >= 1 Account ID (numeric) |
| role required | string Enum: "COACH" "ADMIN" "COACHEE" "ASSOCIATE" "MANAGER" "SPONSOR" "GROUP_ADMIN" User role; gates access to role-specific endpoints |
| email required | string <email> User email address (unique, lowercased server-side) |
{- "accountId": 1,
- "role": "COACH",
- "email": "user@example.com"
}{- "result": "SUCCESS",
- "message": "Operation succeeded",
- "data": { }
}Resends the verification email to a single user.
| emailId required | string <email> Email id UUID |
| accountId | integer >= 1 Account ID (numeric) |
{- "emailId": "550e8400-e29b-41d4-a716-446655440000",
- "accountId": 1
}{- "result": "SUCCESS",
- "message": "Operation succeeded",
- "data": { }
}Sends verification reminders to multiple users.
required | Array of objects non-empty Users |
{- "users": [ ]
}{- "result": "SUCCESS",
- "message": "Operation succeeded",
- "data": { }
}Authenticated password change for the current user.
| currentPassword required | string <password> non-empty Current password — required to authorize the change |
| newPassword required | string <password> >= 8 characters Must contain upper, lower, digit, special char |
{- "currentPassword": "Pa$$w0rd123",
- "newPassword": "Pa$$w0rd123"
}{- "result": "SUCCESS",
- "message": "Operation succeeded",
- "data": { }
}Creates a tokenized registration link for invitation flows.
| role required | string Enum: "SUPER_ADMIN" "COACH" "ADMIN" "COACHEE" "ASSOCIATE" "MANAGER" "SPONSOR" "GROUP_ADMIN" User role; gates access to role-specific endpoints |
| accountId required | integer >= 1 Account ID (numeric) |
| programId | integer Program ID (numeric) |
{- "role": "SUPER_ADMIN",
- "accountId": 1,
- "programId": 0
}{- "result": "SUCCESS",
- "message": "Operation succeeded",
- "data": { }
}Decodes a registration token to inspect embedded user info.
| token required | string non-empty Opaque or JWT token (context-specific) |
{- "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.token.value"
}{- "result": "SUCCESS",
- "message": "Operation succeeded",
- "data": { }
}Creates a user account by accepting an invitation token.
| token required | string non-empty Opaque or JWT token (context-specific) |
| email required | string <email> <= 255 characters User email address (unique, lowercased server-side) |
| name required | string [ 3 .. 100 ] characters Display name |
| password required | string <password> >= 8 characters Must contain upper, lower, digit, special char |
{- "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.token.value",
- "email": "user@example.com",
- "name": "Jane Doe",
- "password": "Pa$$w0rd123"
}{- "result": "SUCCESS",
- "message": "Operation succeeded",
- "data": { }
}Returns the bulk upload result rows as a CSV download.
| uploadId required | string <uuid> Example: 550e8400-e29b-41d4-a716-446655440000 Bulk-upload batch UUID |
{- "result": "FAILURE",
- "message": "Operation failed"
}Service-to-service endpoint to fetch basic user info; used by the calendar service. Requires service-to-service auth (not bearer JWT).
| userId required | integer Example: 0 Numeric user ID |
{- "result": "SUCCESS",
- "message": "Operation succeeded",
- "data": { }
}