Auth APIs

Enopsy Auth Backend — generate a tenant token, verify it, fetch the current user, and log out.

API 1. Generate Token

This API gives a token for a tenant. Pass this token in later requests as the auth-token header, the Authorization header, or as a Bearer token to access other API data.

Endpoint

Headers

x-tenant-id: 65f1a2b3c4d5e6f7a8b9c0d1
Content-Type: application/json

Payload

{
  "username": "[email protected]",
  "password": "secret",
  "isTeam": true
}

Response 200

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "tokenName": "auth_token",
  "session": {
    "payload": {
      "id": "...",
      "_id": "...",
      "name": "...",
      "email": "[email protected]",
      "isTeam": true,
      "tenant": { "tenant_id": "65f1a2b3c4d5e6f7a8b9c0d1" }
    },
    "domain": ".enopsy.com"
  }
}

Use token on later APIs in the header as auth-token, Authorization, or Authorization: Bearer <token>.

Errors

API 2. Logout

This API logs out the tenant user and revokes this token for that tenant only. Other tenants' tokens stay valid. After logout, the same token cannot access other APIs.

Endpoint

Headers

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
Content-Type: application/json

You can also send the token as auth-token: <token>.

Payload

No body is required.

Response 200

{
  "message": "Logged out successfully from all services.",
  "login_url": "https://auth.example.com"
}

Errors

API 3. Verify

This API checks that the tenant token is still valid. Use it after login to confirm the session before opening the dashboard.

Endpoint

Headers

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

You can also send the token as auth-token: <token>.

Query

Payload

No body is required.

Response 200

{
  "message": "Authenticated",
  "user": {
    "id": "...",
    "email": "[email protected]",
    "isTeam": true,
    "isAdmin": true,
    "tenant": { "tenant_id": "65f1a2b3c4d5e6f7a8b9c0d1" }
  },
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "login_url": "https://auth.example.com"
}

Errors

API 4. Me

This API returns the logged-in tenant user's profile and extra details. Use the same token from API 1.

Endpoint

Headers

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

You can also send the token as auth-token: <token>.

Payload

No body is required.

Response 200

{
  "_id": "...",
  "name": "...",
  "email": "[email protected]",
  "role": "...",
  "permissions": [],
  "userDetails": {},
  "decoded": {
    "id": "...",
    "email": "[email protected]",
    "isTeam": true,
    "tenant": { "tenant_id": "65f1a2b3c4d5e6f7a8b9c0d1" }
  }
}

Password is not returned. isTeam: true loads a TeamMember; isTeam: false loads a client User.

Errors