Auth API

Apps and their installations, members' roles, AI agents' access, and whether your organization is live.

The auth service's own routes: the app catalogue, an organization's installations — installed, regranted and removed by its owners and admins, each one a fact in the auth journal — the app session that opens an embedded app's page, and how a first-party app records a consent given elsewhere, mints its token, and vouches for a person with an identity claim it signs itself; the roles owners and admins assign members, and ending or restoring a member's access; how many people have joined; read-only mode and going live; a person's grid layouts; social sign-in inside the mobile app and closing one's own account; enrolled stations and the sessions people open in a view; print agents, the program at each site that reaches its printers; and the AI agents a person consents into an organization; and the platform's view across every organization and partner account. Sign-in, organizations, membership and invitations are BetterAuth's own routes and are not described here.

Base URL

https://auth.getmanifold.io

Auth

A bearer token on every call. See the quickstart.

OpenAPI

auth-service.openapi.json

apps

The app catalogue, and the apps an organization has installed.

• GET /api/auth/apps The app catalogue: every app an organization may install
• GET /api/auth/organizations/{organizationId}/installations The organization's apps
• PUT /api/auth/organizations/{organizationId}/installations/{appId} Install an app in the organization, or consent to it again
• DELETE /api/auth/organizations/{organizationId}/installations/{appId} Remove an app from the organization
• POST /api/auth/organizations/{organizationId}/installations/{appId}/launch Open an embedded app

appIdentity

How a first-party app vouches for who a person is: the identity claim it signs, redeemed for an organization or a session.

• POST /api/auth/apps/{appId}/claim A signed-in person redeems the identity claim an app handed their browser
• POST /api/auth/apps/{appId}/session A session from the claim and the app's fresh presence
• POST /api/auth/apps/{appId}/join-requests A signed-in person asks the organization an app's account is bound to to admit them

members

Who may do what in the organization: members' assigned roles, and ending or restoring a member's access.

• GET /api/auth/roles/{organizationId} Every member of the organization with the roles an owner or admin assigned them
• PUT /api/auth/roles/{organizationId}/{userId} Replace one member's assigned roles with roles — the whole set, not a change to it
• POST /api/auth/members/{organizationId}/{userId}/deactivate End a member's access to the organization without deleting them
• POST /api/auth/members/{organizationId}/{userId}/reactivate Restore a deactivated member's access exactly as it was

mode

Read-only mode: whether Manifold may write outside itself for the organization, and an owner's or admin's decision to go live.

• GET /api/auth/mode Where the caller's organization stands
• POST /api/auth/organizations/{organizationId}/go-live Take the organization out of read-only mode
• POST /api/auth/organizations/{organizationId}/read-only Pin an undecided organization in read-only mode

team

The organization's people as the setup walk reads them: how many have joined.

• GET /api/auth/organizations/{organizationId}/member-count How many people belong to the organization

agents

AI agents (MCP clients) a person has consented into an organization, and how that consent is given and withdrawn.

• GET /api/auth/agent-clients/{clientId} The MCP client asking for a person's consent
• GET /api/auth/agents/{organizationId} The AI agents consented into the organization
• GET /api/auth/surfaces/{organizationId} The connected surfaces of the organization
• PUT /api/auth/agents/{organizationId}/{clientId} The caller's consent on the authorization screen
• PUT /api/auth/agents/{organizationId}/{clientId}/{userId} Change what an existing agent grant holds
• DELETE /api/auth/agents/{organizationId}/{clientId}/{userId} Withdraw an agent's grant

gridLayouts

A person's arrangement of the admin's grids: which columns show, and in what order.

• GET /api/auth/me/grid-layouts How the signed-in person arranged the admin's lists
• PUT /api/auth/me/grid-layouts/{grid} Replace how the signed-in person arranged one grid with order and hidden

nativeSignIn

Social sign-in inside the mobile app: the system browser's session handed to the app by a one-time code.

• POST /api/auth/native/redeem Redeem the one-time code a native social sign-in handed the Manifold mobile app with the…

account

A person's own account: closing it, which deactivates, ends and erases rather than deletes.

• POST /api/auth/me/close Close the signed-in person's own account, for good: confirm must say delete my account

stations

Enrolled stations: devices kept signed in to one view at one location, unlocked by the people who work them.

• GET /api/auth/stations/{organizationId} The organization's enrolled stations
• POST /api/auth/stations/{organizationId} Enrol a device as a station
• PATCH /api/auth/stations/{organizationId}/{stationId} Rename a station — what the device and Settings › Stations call it
• POST /api/auth/stations/{organizationId}/{stationId}/revoke Revoke a station: its device credential unlocks nothing from now on
• PUT /api/auth/station-pins/{organizationId} Set the signed-in person's own station PIN for the organization
• POST /api/auth/station/roster What an enrolled device shows on its lock screen
• POST /api/auth/station/unlock Unlock a station as a person

printAgents

Print agents: the program at each site that reaches its printers, signed in as itself.

• GET /api/auth/print-agents/{organizationId} The organization's print agents
• POST /api/auth/print-agents/{organizationId} Enrol a print agent — the program at a site that sends labels to its printers
• POST /api/auth/print-agents/{organizationId}/{agentId}/revoke Revoke a print agent
• GET /api/auth/organizations/{organizationId}/print-agents/{agentId} One print agent of the organization
• POST /api/auth/print-agent/token Exchange a print agent's credential for its device token

views

Sessions in a personal view: each interface is its own app, and a session is opened in it.

• POST /api/auth/views/{view}/session Exchange the signed-in person's session for a token in one personal view

events

The auth service's append-only event log.

• GET /events Replay the organization's auth facts at-or-after since