Documentation

Written once, for people and machines

Every page here is a markdown file in /docs. This site renders them; it is not where they live. Edit the file and the page follows.

Start here

1 page

Auth API

16 pages
Auth APIEvery endpoint, one page each, with the request and response it actually returns.building
Sign upCreate an account with a six-digit code emailed to the address. No password needed.building
Sign inSign somebody in with a code or a password, read the session back, and end it.building
Verify emailConfirm an address, and send the link again when the first one never arrives.building
Reset a passwordThe forgotten-password flow, enumeration-resistant at both ends.building
Social loginGoogle and GitHub with your own OAuth app — configure, list, disconnect, and sign in.building
Two-factorTOTP and single-use recovery codes. Enable, verify, and what sign-in returns once it is on.building
PasskeysWebAuthn sign-in, bound to your domain rather than ours — and what that constrains.building
OrganizationsWorkspaces inside your app — create them, set roles, invite people, and fill in org_id.building
Enterprise SSOOIDC and SAML 2.0, registered by your customers themselves, with users joining an organization on arrival.building
Directory syncSCIM provisioning — issue a directory a credential, and let it create and deactivate people.building
Get usersList the accounts in a project, newest first, with a cursor and a last-seen time.building
Delete usersTwo ways, because they are two different actions — the person leaving, and you removing them.building
SettingsWhat is fixed by convention, what you still decide per project, and how to change it.building
Tokens and JWKSA short-lived JWT your API verifies locally, so we are not a hop on every request you serve.building
Limits and statesTwo rate limits answering different questions, and what a project still being provisioned returns.building

Files API

9 pages

Data API

10 pages

Platform

3 pages

For machines

The same docs, without the chrome

An AI reading these should not have to strip HTML or run JavaScript. Three plain-text surfaces, served from the same markdown as the pages above, so they cannot drift apart.