The Authentication Service handles user registration, login, and account management operations.

​
Endpoints

​
Sign Up

Create a new user account with organization. 
curl -X POST {{baseUrl}}/api/auth/signup \
  -H "Content-Type: application/json" \
  -d '{
    "email": "user@example.com",
    "first_name": "John",
    "last_name": "Doe",
    "password": "SecurePassword123!"
  }'
Endpoint: POST /api/auth/signup Request Body:
FieldTypeRequiredDescription
emailstringYesUser’s email address
first_namestringYesUser’s first name
last_namestringYesUser’s last name
passwordstringYesUser’s password (must meet security requirements)
Response:
FieldTypeDescription
idstring (UUID)The user’s unique identifier
emailstringUser’s email address
first_namestringUser’s first name
last_namestringUser’s last name

​
Login

Authenticate a user and receive an access token. 
curl -X POST {{baseUrl}}/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "user@example.com",
    "password": "SecurePassword123!"
  }'
Endpoint: POST /api/auth/login Request Body:
FieldTypeRequiredDescription
emailstringYesUser’s email address
passwordstringYesUser’s password
Response:
FieldTypeDescription
access_tokenstringJWT token to be used for authenticated requests
token_typestringThe type of token (always “bearer”)

​
Sign Up via Invitation

Register a new user account through an invitation. 
curl -X POST {{baseUrl}}/api/auth/signup_invite \
  -H "Content-Type: application/json" \
  -d '{
    "first_name": "John",
    "last_name": "Doe",
    "password": "SecurePassword123!",
    "invite_token": "valid-invitation-token"
  }'
Endpoint: POST /api/auth/signup_invite Request Body:
FieldTypeRequiredDescription
first_namestringYesUser’s first name
last_namestringYesUser’s last name
passwordstringYesUser’s password
invite_tokenstringYesThe invitation token received via email
Response:
FieldTypeDescription
idstring (UUID)The user’s unique identifier
emailstringUser’s email address (from invitation)
first_namestringUser’s first name
last_namestringUser’s last name
access_tokenstringJWT token for authentication

​
Error Responses

Status CodeDescription
400Bad Request - Invalid input or validation error
401Unauthorized - Invalid credentials
409Conflict - User already exists
422Unprocessable Entity - Input validation failed
500Internal Server Error - Server-side error

​
Authentication

Most endpoints in this service do not require authentication, as they are used for the authentication process itself. The exceptions are:
  • Password reset endpoints may require a valid reset token
  • Account management endpoints may require a valid JWT token

​
Implementation Notes

  • Passwords are securely hashed using SHA-256
  • JWT tokens have a configurable expiration time
  • Failed login attempts are rate-limited to prevent brute force attacks