Client API Access·Tenant: XYZ
Client API Access
Safe APIs for client products, portals, and customer apps. XYZ can use these to connect their product app (e.g. my-product.xyz.com) with EnOpSy services like auth, billing, support, profile, menu, and permissions. Internal EnOpSy APIs are never exposed here.
Base URL: auth.enopsy.com13 API groupsPublic client APIs onlyHTTPS · token auth
Getting Started · 1
Overview
This page lists every API group EnOpSy can share with client products. Each group is scoped to your tenant, requires a valid access token, and returns only your data. Internal and superadmin APIs are listed separately under Do Not Share and are never callable from client products.
Base URLhttps://auth.enopsy.com
Total API Groups
13
Sharable with client products
Public Client APIs
Safe for tenant use
Scoped to your tenant only
Internal APIs
Not shared
EnOpSy internal team only
Getting Started · 2
Important Architecture Rule
EnOpSy and the client product are two separate systems. They connect only through secure APIs — no code is shared or copied across the boundary.
EnOpSy code is not copied to client product servers.
Client product code is not hosted inside EnOpSy.
Both systems stay separate and connect only by secure APIs.
Client product
my-product.xyz.com
Client auth
app.xyz.com/auth
API
api.enopsy.com
my-product.xyz.comEnOpSy APIVerify user / session / accessReturn safe response
Getting Started · 3
How Client Product Uses EnOpSy API
The session-verification flow a client product follows before opening its dashboard.
1
Customer opens my-product.xyz.com
2
Product checks session
3
If no session, redirect to app.xyz.com/authredirect
4
Auth uses EnOpSy Auth API
5
User logs in
6
Product verifies session using EnOpSy API
7
Product gets profile, product access, menu, billing status
8
Product dashboard opens
Shared APIs
API Groups
Public APIs XYZ can call from their own product apps. Filter by status, risk, or sharing level. Every endpoint below is prefixed with https://api.enopsy.com.
14 groups
Shared API
Auth API
Enabledhigh riskLogin, logout, magic link, OTP, password reset, and session check.
Base URLhttps://backend-auth.enopsy.com/api/auth
| Endpoint | Method | |
|---|---|---|
| https://backend-auth.enopsy.com/api/auth/login-by-email | POST | |
| https://backend-auth.enopsy.com/api/auth/signin-by-phone | POST | |
| https://backend-auth.enopsy.com/api/auth/magic-login/client | POST | |
| https://backend-auth.enopsy.com/api/auth/client/verify | GET | |
| https://backend-auth.enopsy.com/api/auth/send-otp | POST | |
| https://backend-auth.enopsy.com/api/auth/verify-otp | POST | |
| https://backend-auth.enopsy.com/api/auth/client/logout | POST | |
| https://backend-auth.enopsy.com/api/auth/add-user-details | POST | |
| https://backend-auth.enopsy.com/api/auth/reset-password-request | GET | |
| https://backend-auth.enopsy.com/api/auth/reset-password/{token} | GET |
Main use cases
client loginSession checkPassword resetMagic link loginOTP login
Shared API
Client API
Enabledmedium riskAllow XYZ to manage their own clients.
Base URLhttps://backend-auth.enopsy.com
| Endpoint | Method | |
|---|---|---|
| https://backend-auth.enopsy.com/api/auth/get-user-details/client/{userId} | GET | |
| https://backend-auth.enopsy.com/api/auth/update-user-details/client | PUT | |
| https://backend-auth.enopsy.com/api/auth/client/me | GET | |
| https://backend-auth.enopsy.com/api/company-details/client/{userId} | GET | |
| https://backend-auth.enopsy.com/api/company-details/client/{userId}/{companyId} | PUT |
Main use cases
Create clientView clientUpdate clientBlock clientActivate client
Shared API
Profile API
Enabledlow riskManage the logged-in user profile.
Base URLhttps://backend-auth.enopsy.com
| Endpoint | Method | |
|---|---|---|
| https://backend-auth.enopsy.com/api/auth/get-user-details/client/{userId} | GET | |
| https://backend-auth.enopsy.com/api/auth/update-user-details/client | POST | |
| https://backend-auth.enopsy.com/api/company-details/client/{userId} | GET | |
| https://backend-auth.enopsy.com/api/company-details/client/{userId}/{companyId} | PUT | |
| https://backend-auth.enopsy.com/api/auth/reset-password-request | GET | |
| https://backend-auth.enopsy.com/api/auth/reset-password/{token} | GET |
Main use cases
My profileChange nameChange phoneChange emailChange password
Shared API
Product API
Enabledmedium riskManage product access for products like my-product.xyz.com.
Base URLhttps://auth.enopsy.com/api/products
| Endpoint | Method | |
|---|---|---|
| https://auth.enopsy.com/api/products | GET | |
| https://auth.enopsy.com/api/products | POST | |
| https://auth.enopsy.com/api/products/{product_id} | GET | |
| https://auth.enopsy.com/api/products/{product_id} | PUT | |
| https://auth.enopsy.com/api/products/{product_id}/access | GET | |
| https://auth.enopsy.com/api/products/{product_id}/assign-customer | POST | |
| https://auth.enopsy.com/api/products/{product_id}/remove-customer | POST |
Main use cases
List productsCreate productCheck product accessAssign customerRemove access
Shared API
Module API
Enabledlow riskShow custom modules for XYZ customers and products.
Base URLhttps://backend-auth.enopsy.com
| Endpoint | Method | |
|---|---|---|
| https://backend-auth.enopsy.com/api/group-modules/get-all | GET | |
| https://backend-auth.enopsy.com/api/group-modules/create | POST | |
| https://backend-auth.enopsy.com/api/group-modules/delete/{moduleId} | DELETE | |
| https://backend-auth.enopsy.com/api/group-modules/edit-module | POST | |
| https://backend-auth.enopsy.com/api/group-modules/get-details/{moduleId} | GET | |
| https://backend-auth.enopsy.com/api/group-modules/edit-module-permission | POST |
Main use cases
Add moduleRemove moduleModule by IDModule by roleEdit Module
Shared API
Permission API
Enabledhigh riskCheck what a user can see and do.
Base URLhttps://backend-auth.enopsy.com
| Endpoint | Method | |
|---|---|---|
| https://backend-auth.enopsy.com/api/auth/role-permission?module=Settings | GET | |
| https://backend-auth.enopsy.com/api/department/stats | GET | |
| https://backend-auth.enopsy.com/api/department/get-all | GET | |
| https://backend-auth.enopsy.com/api/department/create | POST | |
| https://backend-auth.enopsy.com/api/department/delete/{departmentId} | DELETE | |
| https://backend-auth.enopsy.com/api/department/edit-department-visibility/{departmentId}s | GET | |
| https://backend-auth.enopsy.com/api/department/get-details/{departmentId} | GET | |
| https://backend-auth.enopsy.com/api/auth/get-users-not-in-department/{departmentId} | GET | |
| https://backend-auth.enopsy.com/api/auth/remove-user-permission | POST | |
| https://backend-auth.enopsy.com/api/auth/update-permission-group | POST |
Main use cases
Check roleCheck permissionGive role to customerProtect features
Shared API
Billing API
Enabledhigh riskOrders, invoices, payments, subscriptions, and plans.
Base URLhttps://backend-billing.enopsy.com/api/v1/client
| Endpoint | Method | |
|---|---|---|
| https://backend-billing.enopsy.com/plan/subscription?origin={product}&source={product}&userId={id} | GET | |
| https://backend-billing.enopsy.com/card?origin={product}&source={product}&userId={id} | GET | |
| https://backend-billing.enopsy.com/order?origin={product}&source={product}&userId={id} | GET | |
| https://backend-billing.enopsy.com/order/{order_id} | GET | |
| https://backend-billing.enopsy.com/invoice?origin={product}&source={product}&userId={id} | GET | |
| https://backend-billing.enopsy.com/invoice/{invoice_id} | GET | |
| https://backend-billing.enopsy.com/transaction?origin={product}&source={product}&userId={id} | GET | |
| https://backend-billing.enopsy.com/transaction/{transaction_id} | GET |
Main use cases
Show plansCreate orderShow invoicePay invoiceView transactionManage subscription
Shared API
Support API
Enabledmedium riskTicket system for XYZ customers.
Base URLhttps://backend-dashboard.enopsy.com
| Endpoint | Method | |
|---|---|---|
| https://backend-dashboard.enopsy.com/department/client | GET | |
| https://backend-dashboard.enopsy.com/ticket/client | POST | |
| https://backend-dashboard.enopsy.com/ticket/client/client-tickets?userId=${currentUser} | GET | |
| https://backend-dashboard.enopsy.com/reply/client?ticketId=${id} | GET | |
| https://backend-dashboard.enopsy.com/ticket/client/id/?ticketId=${id} | GET | |
| https://backend-dashboard.enopsy.com/ticket/client | PUT | |
| https://backend-dashboard.enopsy.com/reply/client | POST |
Main use cases
Create ticketList ticketsReply to ticketClose ticketReopen ticket
Shared API
Branding API
Enabledlow riskWhite-label setup for XYZ.
Base URLhttps://auth.enopsy.com/api/branding
| Endpoint | Method | |
|---|---|---|
| https://auth.enopsy.com/api/branding | GET | |
| https://auth.enopsy.com/api/branding | PUT | |
| https://auth.enopsy.com/api/branding/logo | GET | |
| https://auth.enopsy.com/api/branding/logo | PUT | |
| https://auth.enopsy.com/api/branding/theme | GET | |
| https://auth.enopsy.com/api/branding/theme | PUT |
Main use cases
LogoColorsFaviconCompany nameSupport emailTerms linkPrivacy link
Shared API
Domain / Redirect API
Enabledhigh riskSafe domains and login redirect.
Base URLhttps://auth.enopsy.com/api/domains
| Endpoint | Method | |
|---|---|---|
| https://auth.enopsy.com/api/domains | GET | |
| https://auth.enopsy.com/api/domains | POST | |
| https://auth.enopsy.com/api/domains/{domain_id} | DELETE | |
| https://auth.enopsy.com/api/domains/verify | POST | |
| https://auth.enopsy.com/api/auth/redirect/validate | POST |
Main use cases
Add app.xyz.comAdd my-product.xyz.comVerify domainAllow redirect URLBlock unknown domains
Shared API
Notification API
Optionalmedium riskEmail, in-app, and payment alerts.
Base URLhttps://auth.enopsy.com/api/notifications
| Endpoint | Method | |
|---|---|---|
| https://auth.enopsy.com/api/notifications | GET | |
| https://auth.enopsy.com/api/notifications | POST | |
| https://auth.enopsy.com/api/notifications/{id}/read | POST | |
| https://auth.enopsy.com/api/notifications/preferences | PUT |
Main use cases
Login alertsPayment remindersTicket updatesIn-app alertsNotification settings
Shared API
Webhook API
Optionalhigh riskSend EnOpSy events to the XYZ product system.
Base URLhttps://auth.enopsy.com/api/webhooks
| Endpoint | Method | |
|---|---|---|
| https://auth.enopsy.com/api/webhooks | GET | |
| https://auth.enopsy.com/api/webhooks | POST | |
| https://auth.enopsy.com/api/webhooks/{webhook_id} | PUT | |
| https://auth.enopsy.com/api/webhooks/{webhook_id} | DELETE | |
| https://auth.enopsy.com/api/webhooks/test | POST |
Webhook events
customer.createdcustomer.logininvoice.paidpayment.failedticket.createdticket.repliedsubscription.cancelled
Main use cases
Sync customer dataSync payment eventsSync ticket eventsNotify XYZ backend
Shared API
Audit Log API
Limitedmedium riskShow activity logs for the XYZ tenant only.
Base URLhttps://auth.enopsy.com/api/audit-logs
| Endpoint | Method | |
|---|---|---|
| https://auth.enopsy.com/api/audit-logs | GET | |
| https://auth.enopsy.com/api/audit-logs/customer/{customer_id} | GET | |
| https://auth.enopsy.com/api/audit-logs/security | GET |
Main use cases
Login historyProfile changesBilling activitySupport activitySecurity logs
Reference
API Security Rules
Apply every rule below before a client product goes live. Hiding a menu is not a security control.
Every API request must include a tenant_id
Every API request must verify the access token
Product must verify session before loading dashboard
API must never return another tenant's data
Approved domains only
Approved redirect URLs only
Rate limit per client
API keys must be rotated
Logs must be saved
Webhooks must use a signing secret
Menu hiding is not real security
API permission must be checked
Reference
API Access Summary
At-a-glance view of what is shared, its purpose, and its risk level.
| API Group | Shared With Client | Main Purpose | Risk Level | Status |
|---|---|---|---|---|
| Auth API | Yes | Login and session | high risk | Enabled |
| Client API | Yes | Manage own customers | medium risk | Enabled |
| Profile API | Yes | User profile | low risk | Enabled |
| Product API | Yes | Product access | medium risk | Enabled |
| Menu API | Yes | Custom menu | low risk | Enabled |
| Permission API | Yes | Role and access check | high risk | Enabled |
| Billing API | Yes | Orders and invoices | high risk | Enabled |
| Support API | Yes | Tickets | medium risk | Enabled |
| Branding API | Yes | White-label setup | low risk | Enabled |
| Domain API | Yes | Safe redirect / domain | high risk | Enabled |
| Notification API | Optional | Alerts | medium risk | Optional |
| Webhook API | Optional | Event sync | high risk | Optional |
| Audit Log API | Limited | Tenant logs only | medium risk | Limited |
Copied to clipboard