Origin and namespace
Authentication is installation-local under /auth/admin/... or /auth/customer/..., using the exact configured HTTPS origin. The service rejects the wrong host, cross-site mutation, unknown namespace/action and malformed query. Only supported token inventory GET accepts its bounded query. Cookies, CSRF and full/fresh session assurance remain separate checks. Marketplace login is not a local credential.
Sign-in and session routes
| Method | Action after /auth/{namespace}/ |
Behavior |
|---|---|---|
| POST | login |
Verify local login/password under the installed credential-source and MFA policy. |
| GET | session |
Inspect own role, login, account, MFA methods/policy and permitted Admin metadata. |
| GET | csrf |
Obtain/rotate own CSRF through the same-origin Panel request contract; it does not sign in or authorize a write. |
| POST | logout, logout-all |
End the current or own permitted sessions according to the confirmed server result. |
| POST | reauth |
Verify current password and refresh eligible completed sign-in; incomplete MFA stays incomplete. |
| POST | password/change |
Change the local Panel password through fresh protected identity flow. |
| POST | request-recovery, recover |
Configured recipient recovery request or one-use local grant plus new password; receipt is not inferred. |
Factors and recovery codes
Authenticator actions are totp/begin, totp/finish, totp/verify; complete the first-code/challenge flow before treating a factor as enrolled. WebAuthn uses passkey/register/begin, /finish, passkey/assert/begin, /finish and the browser's origin-bound credential response. recovery-code, mfa/reset and recovery-codes are protected factor-recovery/rotation actions, not public MFA bypasses.
GET mfa/settings reads current policy/capability. POST /auth/admin/mfa/policy changes the eligible installation policy; POST mfa/disable is permitted only when the installed policy allows it and the current password/full security change is verified. Disabling a factor cannot override mandatory installation MFA, and confirmed changes revoke other sessions/tokens as documented by the actual result.
Sessions, administrators and tokens
sessions lists your own sessions; sessions/revoke takes the intended session ID. Administrator inventory is /auth/admin/administrators; /permissions accepts principal ID and delegated permission list within the current actor's authority. Owner grants stay protected. users creates eligible additional local administrators, lock is an identity-management action and view starts the separately audited read-only Customer view.
tokens supports GET inventory and POST expiring credential creation; tokens/revoke revokes by metadata ID. Owner inventory/action scopes and Customer scopes remain distinct. extension-token issues only a fresh short-lived manifest-bound extension credential; /extension-admission is the parent's fixed admission check, not an extension-selected privileged operation.
Customer View and first enrollment
/auth/view/session and /csrf inspect the expiring read-only view; POST /auth/view/exit exits it. Other writes are denied. First enrollment uses the separately protected /setup/enroll boundary and local enrollment window, not a public signup service. Use the approved local grant/owner recovery CLI for expired/lost enrollment according to the exact release; never put recovery secrets in a URL or public report.