Account and Public Configuration

Overview

These endpoints support Bar9's browser account lifecycle. Public configuration, access applications, sign-up, sign-in, password recovery, OAuth discovery, and email verification do not require an existing session. Profile, export, password-change, sign-out, and account-erasure operations use the secure dashboard session cookie. API keys cannot authenticate account-management routes.

All JSON success responses use { "ok": true, "data": ... }. JSON errors use { "ok": false, "error": { "code", "message" } }. Public forms can require turnstile_token when bot protection is enabled.

GET /v1/public/config

Returns the public registration configuration, enabled OAuth provider names, Turnstile site key, invite-only flag, and published retention periods. No authentication is required.

GET /v1/public/pricing

Returns the current public per-carrier tariff table. No authentication is required. Monetary values and their currency come from the active effective-dated customer tariffs.

POST /v1/access-applications

Requests invite-only access. Send full_name, email, company, reason, and optional turnstile_token. Success returns 201 Created. Invalid fields return 400; an existing account or application for the address returns 409.

GET /v1/auth/oauth/providers

Lists the configured OAuth provider identifiers. GET /v1/auth/oauth/:provider starts the authorization flow with a 302 redirect, and GET /v1/auth/oauth/:provider/callback validates provider state, creates the session cookie, and redirects to profile completion or the dashboard. Unknown providers or invalid state are rejected.

POST /v1/auth/sign-up/email

curl https://api.bar9.dev/v1/auth/sign-up/email \
  -H 'Content-Type: application/json' \
  -d '{"name":"Amine Example","email":"[email protected]","password":"a-long-password","company_name":"Example SARL","invite_token":"invite-token"}'

Returns 201 Created and sets the session cookie. email and password are required; invite-only deployments also require a valid unused invitation. Validation failures return 400, reused email addresses return 409, and invalid invitations return 403.

POST /v1/auth/sign-in/email

Accepts email, password, and optional turnstile_token. Success returns the user and session metadata and sets the session cookie. Invalid credentials return 401; suspended accounts return 403.

GET /v1/auth/get-session

Returns the current user for a valid session cookie. Missing, expired, or revoked sessions return 401.

POST /v1/auth/sign-out

Revokes the current session, clears its cookie, and returns 204 No Content. A session cookie is required.

POST /v1/auth/forgot-password

Accepts { "email": "[email protected]" } and always returns a neutral recovery result to avoid account enumeration. POST /v1/auth/forget-password is a compatibility alias with the same contract. Production sends the reset link by email; non-production responses may expose the token for local testing.

POST /v1/auth/reset-password

Accepts token and password (or the compatibility field new_password). A valid unused token changes the password and invalidates the reset token. Invalid or expired tokens return 400.

POST /v1/auth/change-password

Requires a user session. Send current_password and new_password. Incorrect credentials return 401; an invalid new password returns 400.

PATCH /v1/auth/profile

Requires a user session and updates the supported profile fields, including name and company metadata. Empty or invalid values return 400.

GET /v1/auth/data-export

Requires a user session and downloads the owner-scoped data export. The export includes account, message, OTP, payment, consent, and audit data retained by Bar9; secrets and hashes are excluded.

DELETE /v1/auth/account

Requires a user session and a JSON credential confirmation. It anonymizes or removes eligible personal data, revokes credentials, clears the session cookie, and returns 204 No Content. Regulatory and ledger records that must be retained are minimized rather than deleted. Incorrect confirmation returns 401; conflicting protected state returns 409.

POST /v1/auth/send-verification-email

Requires a user session and queues a new verification email. Already-verified accounts receive an idempotent result. Delivery configuration failures return 503.

GET /v1/auth/verify-email

Accepts the verification token query parameter. Success verifies the email address and returns the updated result. Invalid, expired, or already-consumed tokens return 400.

Common errors