Session reference

Session endpoint authentication, parameters, request and response contracts.

Last updated: 10 November 2026

Paths, methods, parameters and available schemas are generated from the OpenAPI document in the repository.

Note: These endpoints form the browser application contract and do not provide the same versioning assurance as v1. Use the versioned API for external integrations.

POST /api/auth/login

Sign in

Authentication: Authentication is not required. Scope: Relevant organisation/project membership and operation permission; writes also check the current role, module and licence permissions.

Request body

application/json

Responses

HTTP 200

application/json

This OpenAPI document does not define a body schema. See the relevant developer guide for details.

HTTP 422

application/json

For error meanings and client actions, see the error code glossary.

POST /api/auth/logout

Sign out

Authentication: User session (cookie). Scope: Relevant organisation/project membership and operation permission; writes also check the current role, module and licence permissions.

Responses

HTTP 200

application/json

This OpenAPI document does not define a body schema. See the relevant developer guide for details.

For error meanings and client actions, see the error code glossary.

GET /api/auth/check

Check authentication

Reverse-proxy forward authentication: static application and basemap files are available only to signed-in users.

Authentication: User session (cookie). Scope: Relevant organisation/project membership and operation permission; writes also check the current role, module and licence permissions.

Responses

HTTP 200

application/json

This OpenAPI document does not define a body schema. See the relevant developer guide for details.

For error meanings and client actions, see the error code glossary.

GET /api/auth/me

Current user

Authentication: User session (cookie). Scope: Relevant organisation/project membership and operation permission; writes also check the current role, module and licence permissions.

Responses

HTTP 200

application/json

This OpenAPI document does not define a body schema. See the relevant developer guide for details.

For error meanings and client actions, see the error code glossary.

POST /api/auth/password

Change password

Authentication: User session (cookie). Scope: Relevant organisation/project membership and operation permission; writes also check the current role, module and licence permissions.

Request body

application/json

Responses

HTTP 200

application/json

This OpenAPI document does not define a body schema. See the relevant developer guide for details.

HTTP 422

application/json

For error meanings and client actions, see the error code glossary.