Endpoints
Signup and accounts
Self-serve signup for buyers and sellers, and the email/password console login. These are the only routes you can call without an API key.
Signup
/v1/signupNo auth. Claims an address and sends a confirmation email. Creates nothing yet.
| Field | Type | Required | Notes |
|---|---|---|---|
role | "buyer" | "seller" | yes | |
email | string | yes | |
organizationName | string | yes | |
website | string | no | helps seller verification |
dailyBudgetMinor | string | no | buyers only: the workspace's daily cap in cents |
password | string | no | enables console sign-in once the email is confirmed |
// 202
{ "signupId": "sgn_…", "status": "pending", "expiresAt": "…", "emailSent": true }There's one pending signup per email and role. Asking again resends the email for the same signup. The response is identical whether or not the address is already known.
/v1/signup/verifyNo auth. Uses the emailed token and creates the tenant and its root key.
| Field | Type | Required |
|---|---|---|
token | string, from the email link | yes |
// 201
{
"signupId": "sgn_…", "role": "seller", "status": "completed",
"tenant": { "kind": "provider", "id": "prv_…", "name": "Acme OCR", "walletId": "wal_…" },
"credential": { "keyId": "akey_…", "token": "zk.akey_….…", "label": "…", "scopes": ["…"] }
}credential.token is shown once. walletId (sellers only) is the settlement wallet. The token can be used only once and expires after 24 hours. If two requests use it at the same moment, only one tenant is created.
/v1/signup/resendNo auth. Body { role, email }. Always returns 202. Invalidates the previous link.
/v1/signup/:idNo auth. The status of a signup by its signupId: pending, completed or expired. Returns no email address and no token.
Console accounts
A console session is an ordinary API key of kind session, limited to your tenant.
/v1/accounts/loginNo auth. Body { email, password }. Returns { sessionToken, expiresAt?, scopes, account }. Failed attempts count toward a lockout.
/v1/accounts/logoutRevokes the session presenting it. It refuses an ordinary API key, so an agent's key can't be revoked from a sign-out button by mistake.
/v1/accounts/meThe account behind the current session. Returns 404 for an ordinary API key.
/v1/accounts/password/forgotNo auth. Body { email }. Always returns 202 with the same body.
/v1/accounts/password/resetNo auth. Body { token, password }. Revokes every console session and no API keys, so your agents keep running.
/v1/accounts/passwordChanges the password while signed in. Body { currentPassword, newPassword }.