Auth
Authentication and session management
Register a new user account by redeeming an invitation token
Register a new user account by redeeming an invitation token. Registration is invitation-only: the token identifies the tenant, the organisation role and, for a project-scoped invitation, the project the new account is granted access to.
Authenticate and receive a session
Authenticate and receive a session
End the current session
End the current session
Get the currently authenticated user
Get the currently authenticated user
Get the current user's resolved permissions for the active organisation
Get the current user's resolved permissions for the active organisation
List the caller's live CLI sessions
List the caller's live CLI sessions. One entry per `npx pt login` — that is, per refresh-token FAMILY, not per token: a session that has refreshed twenty times is still one row. Browser-session only: the proxy rejects a request that carries no cookies, so a bearer API key cannot enumerate a user's sessions. A non-JSON upstream body is replaced with a `DIRECTORY_INVALID_RESPONSE` envelope while the UPSTREAM STATUS IS PRESERVED, so a 2xx can carry that error shape instead of `data` — the 200 schema below models both.
End one CLI session
End one CLI session. Always revokes the whole refresh family, so the session can no longer refresh. Also revokes the bridge access tokens LINKED to that family, and where at least one was revoked access stops within the ~30s principal-liveness cache window rather than at the end of that token's TTL. Returns what was actually revoked: `accessTokensRevoked` is legitimately 0 for a family whose backing key rows predate the `cli_family_id` link — nothing links them, so the token that machine already holds runs to its own expiry. Browser-session only. A non-JSON upstream body is replaced with a `DIRECTORY_INVALID_RESPONSE` envelope while the UPSTREAM STATUS IS PRESERVED, so a 2xx can carry that error shape instead of `data` — the 200 schema below models both.