/v1/auth
Identity and tokens — anonymous signup, service-account minting, whoami, and revoke.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
curl -X POST "https://example.com/v1/auth/signup" \ -H "Content-Type: application/json" \ -d '{}'{ "token": "string", "jti": "string", "expires_at": "2019-08-24T14:15:22Z", "user_id": "string", "scope": "string", "tier": "string"}Authorization
bearer PASETO v4 public token (or deployment gate key). Auth-disabled dev instances accept any caller.
In: header
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
curl -X POST "https://example.com/v1/auth/tokens" \ -H "Content-Type: application/json" \ -d '{ "subject": "string" }'{ "token": "string", "jti": "string", "expires_at": "2019-08-24T14:15:22Z"}Authorization
bearer PASETO v4 public token (or deployment gate key). Auth-disabled dev instances accept any caller.
In: header
Response Body
application/json
application/json
curl -X GET "https://example.com/v1/auth/whoami"{ "caller": "string", "tenant_id": "string", "deployment_preset": "string", "token": { "jti": "string", "iss": "string", "exp": 0 }, "effective_capabilities": [ "string" ]}Authorization
bearer PASETO v4 public token (or deployment gate key). Auth-disabled dev instances accept any caller.
In: header
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
curl -X POST "https://example.com/v1/auth/revoke" \ -H "Content-Type: application/json" \ -d '{ "jti": "string" }'CortexDB uses PASETO v4 public tokens. Every authenticated request carries
Authorization: Bearer <token> and X-Cortex-Actor (which must match the token's sub).
Endpoints
POST /v1/auth/signup {}— anonymous free-tier token (7-day TTL). Returns{ token, user_id, scope, expires_at }.POST /v1/auth/tokens— mint a service-account token (requires theauth.mintcapability; 1–24h TTL).GET /v1/auth/whoami→{ caller, tenant_id, deployment_preset, token: { jti, iss, exp }, effective_capabilities }.POST /v1/auth/revoke { jti, reason }→204.
Signup/tokens return 503 when a minter key is configured
On a server with a key configured but the v1 minter disabled, POST /v1/auth/signup and
POST /v1/auth/tokens return 503 NOT_CONFIGURED ("self-serve signup requires the v1 minter").
Enable minting with CORTEX_V1_MINTER_ENABLE=1, or have your IdP mint PASETO tokens that CortexDB
verifies. deployment_preset is dev_local self-hosted (vs cloud_shared_saas on the cloud).
Token-enforcement semantics need a real key to verify
On a self-hosted server started with no CORTEX_API_KEY (or the noauth-local sentinel), key
enforcement is effectively off — a request with only X-Cortex-Actor and no Authorization can
return 200, so the 401 MISSING_TOKEN / ACTOR_MISMATCH paths are not exercised there. Error codes
follow the server's uppercase convention (MISSING_TOKEN, TOKEN_EXPIRED, ACTOR_MISMATCH,
POLICY_DENIED). See Authorization.