Account portal API
Routes under /api/v1/me require a bearer access token whose audience includes account-portal. Ownership is always derived from the token subject.
Account and profile
| Method | Route | Purpose |
|---|---|---|
| GET | /api/v1/me | Return the current account snapshot. |
| GET | /api/v1/me/accounts | Return accounts remembered in the active IdP session. |
| PATCH | /api/v1/me/profile | Update name, avatar, date of birth, or gender. |
| POST | /api/v1/me/profile/avatar-upload-urls | Create a signed avatar upload URL. |
| PATCH | /api/v1/me/identifiers | Update account email/phone identifiers. |
| POST | /api/v1/me/password | Change the password after validating current_password. |
| DELETE | /api/v1/me | Delete the current account. |
Sessions and logout
| Method | Route | Purpose |
|---|---|---|
| DELETE | /api/v1/me/sessions/{id} | Revoke one owned session. |
| POST | /api/v1/me/sessions/revoke-others | Revoke every session except the current one. |
| POST | /api/v1/me/logout | Log out the current account/session. |
| POST | /api/v1/me/logout/all | Log out all remembered accounts and coordinate client logout. |
MFA
GET /api/v1/me/security/mfa lists factors. Enrollment start and verification pairs exist for totp, sms, and email. Disable a factor with DELETE /api/v1/me/security/mfa/{factor_id} and regenerate recovery codes with POST /api/v1/me/security/mfa/recovery-codes/regeneration.
Connected and developer applications
GET /api/v1/me/connected-apps lists granted clients; DELETE /api/v1/me/connected-apps/{client_id} revokes one. Developer-owned applications are available under /api/v1/me/developer-apps; see Developer applications.