Appearance
auth
11 endpoints at a glance
| Method | Path | Summary |
|---|---|---|
POST | /auth/login | Login |
POST | /auth/logout | Logout |
GET | /auth/me | Me |
PATCH | /auth/me | Update Me |
POST | /auth/me/password | Change Password |
POST | /auth/register | Register |
GET | /auth/users/ | List Users |
POST | /auth/users/ | Create User |
DELETE | /auth/users/{username} | Delete User |
PATCH | /auth/users/{username} | Update User |
POST | /auth/users/{username}/password | Admin Reset Password |
auth
Login
POST
/auth/login
Verify credentials, set the session cookie, return the user.
Generic 401 on any failure — never leak whether the username exists.
Request Body
application/json
JSON "username": "string", "password": "string"
{
}
Responses
Successful Response
application/json
JSON "additionalProperties": "string"
{
}
Register
POST
/auth/register
Self-serve signup. Creates a viewer and auto-logs in.
Two failure modes return 409 — username already taken, or the
given ally code is already linked to another account. The data
layer's unique indexes (username, player_id) enforce both;
we disambiguate by inspecting which key the duplicate fired on.
Officers and admins are still admin-created via POST /auth/users/.
Self-registration intentionally has no role field on the wire.
Request Body
application/json
JSON "username": "string", "password": "string", "player_id": "string"
{
}
Responses
Successful Response
application/json
JSON "additionalProperties": "string"
{
}
Logout
Me
Update Me
PATCH
/auth/me
Patch the current user's preferences.
Only fields explicitly present in the request body are touched —
pydantic's model_fields_set gives us the explicit-set list, so
we can distinguish "omit" from "set to null" without a sentinel
on the wire.
Parameters
Request Body
application/json
JSON "player_id": "string", "preferences": { "additionalProperties": "string" }
{
}
Responses
Successful Response
application/json
JSON "additionalProperties": "string"
{
}