openapi: 3.0.3 info: title: Blind Insight REST accounts API version: 10.22.0 description: End-to-end encrypted datastore tags: - name: accounts paths: /api/accounts/change-password/: post: operationId: accounts_change-password description: 'Change the password of the currently authenticated user. The `old_password` field must match the currently set password. The `password` and `password_confirm` fields must match. The response will be a detail message indicating if the password change was successful. **On the command line:** ```bash blind accounts change-password --data password-change.json ```' summary: Change user password tags: - accounts requestBody: content: application/json: schema: $ref: '#/components/schemas/ChangePassword' application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/ChangePassword' multipart/form-data: schema: $ref: '#/components/schemas/ChangePassword' required: true security: - cookieAuth: [] - basicAuth: [] - jwtAuth: [] responses: '200': content: application/json: schema: $ref: '#/components/schemas/PasswordChanged' description: '' '400': content: application/json: schema: $ref: '#/components/schemas/PasswordChangedError' description: '' /api/accounts/login/: post: operationId: accounts_login description: 'Log in a user using their email and password. On success, returns a JSON web token which should be included in the `Authorization` header for all subsequent API requests in client implementations. The response will be a detail message indicating if the login was successful. **On the command line:** ```bash blind accounts login --data login.json ```' summary: Login a user account tags: - accounts requestBody: content: application/json: schema: $ref: '#/components/schemas/DefaultLogin' application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/DefaultLogin' multipart/form-data: schema: $ref: '#/components/schemas/DefaultLogin' required: true security: - cookieAuth: [] - basicAuth: [] - jwtAuth: [] - {} responses: '200': content: application/json: schema: $ref: '#/components/schemas/LoginSuccessful' description: '' '400': content: application/json: schema: $ref: '#/components/schemas/LoginSuccessfulError' description: '' /api/accounts/logout/: post: operationId: accounts_logout description: 'Log out the currently authenticated user. This simply invalidates the JSON web token used. This is separate from the porcelain `blind logout` command which removes stored credentials on the local machine. The response will be a detail message indicating if the logout was successful. **On the command line:** ```bash blind accounts logout ```' summary: Logout a user account tags: - accounts requestBody: content: application/json: schema: $ref: '#/components/schemas/Logout' application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/Logout' multipart/form-data: schema: $ref: '#/components/schemas/Logout' security: - cookieAuth: [] - basicAuth: [] - jwtAuth: [] responses: '200': content: application/json: schema: $ref: '#/components/schemas/LogoutSuccessful' description: '' '400': content: application/json: schema: $ref: '#/components/schemas/LogoutSuccessfulError' description: '' /api/accounts/profile/: get: operationId: accounts_profile_retrieve description: 'Retrieve the profile of the currently authenticated user. The response will be the profile object. **On the command line:** ```bash blind accounts profile retrieve ```' summary: Get user profile tags: - accounts security: - cookieAuth: [] - basicAuth: [] - jwtAuth: [] responses: '200': content: application/json: schema: $ref: '#/components/schemas/DefaultUserProfile' description: '' post: operationId: accounts_profile_create description: 'Create a profile for the currently authenticated user. This is useful if you don''t have a profile yet, or if you want to edit an existing profile. The response will be the newly created profile object. **On the command line:** ```bash blind accounts profile create --data profile.json ```' summary: Create user profile tags: - accounts requestBody: content: application/json: schema: $ref: '#/components/schemas/DefaultUserProfile' application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/DefaultUserProfile' multipart/form-data: schema: $ref: '#/components/schemas/DefaultUserProfile' security: - cookieAuth: [] - basicAuth: [] - jwtAuth: [] responses: '200': content: application/json: schema: $ref: '#/components/schemas/DefaultUserProfile' description: '' put: operationId: accounts_profile_update description: 'Replace the currently authenticated user''s profile with the data provided in the request. Fields not specified in the request will be dropped. The response will be the updated profile object. **On the command line:** ```bash blind accounts profile update --data profile.json ```' summary: Update user profile tags: - accounts requestBody: content: application/json: schema: $ref: '#/components/schemas/DefaultUserProfile' application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/DefaultUserProfile' multipart/form-data: schema: $ref: '#/components/schemas/DefaultUserProfile' security: - cookieAuth: [] - basicAuth: [] - jwtAuth: [] responses: '200': content: application/json: schema: $ref: '#/components/schemas/DefaultUserProfile' description: '' patch: operationId: accounts_profile_partial-update description: 'Update one or more fields of the currently authenticated user''s profile. This does not replace the entire profile, it only updates the fields provided in the request. The response will be the updated profile object. **On the command line:** ```bash blind accounts profile partial-update --data profile-update.json ```' summary: Partially update user profile tags: - accounts requestBody: content: application/json: schema: $ref: '#/components/schemas/PatchedDefaultUserProfile' application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/PatchedDefaultUserProfile' multipart/form-data: schema: $ref: '#/components/schemas/PatchedDefaultUserProfile' security: - cookieAuth: [] - basicAuth: [] - jwtAuth: [] responses: '200': content: application/json: schema: $ref: '#/components/schemas/DefaultUserProfile' description: '' /api/accounts/register/: post: operationId: accounts_register description: "This endpoint registers a new user. The user will receive an email with a link to activate their account.\n\nThis will also create a new Organization for the user. The user will be the owner of the organization.\n\nSee the [user registration](https://docs.blindinsight.io/) documentation for more information.\n\nThe response will be the newly created user object.\n\n**On the command line:**\n\nYou can supply record data on standard input with the `--data -` or write it to\na file and give the `--data ` flag.\n\n```bash\nblind accounts register --data '{\n \"email\": \"demo@example.com\",\n \"first_name\": \"Demo\",\n \"last_name\": \"User\",\n \"organization_name\": \"Demo\",\n \"password\": \"pass1234\",\n \"password_confirm\": \"pass1234\"\n}'\n```" summary: Register a new user account tags: - accounts requestBody: content: application/json: schema: $ref: '#/components/schemas/OrganizationRegisterUser' application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/OrganizationRegisterUser' multipart/form-data: schema: $ref: '#/components/schemas/OrganizationRegisterUser' required: true security: - cookieAuth: [] - basicAuth: [] - jwtAuth: [] - {} responses: '200': content: application/json: schema: $ref: '#/components/schemas/OrganizationUserProfile' description: '' /api/accounts/register-email/: post: operationId: accounts_register-email description: 'Register a new email address for the currently authenticated user. This is useful if the user wants to change email addresses associated with their account. The new email must be verified before it is associated with the account. The response will be a detail message indicating if the email was registered. **On the command line:** ```bash blind accounts register-email --data ''{"email": "demo-example@example.com"}'' ```' summary: Register user email tags: - accounts requestBody: content: application/json: schema: $ref: '#/components/schemas/DefaultRegisterEmail' application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/DefaultRegisterEmail' multipart/form-data: schema: $ref: '#/components/schemas/DefaultRegisterEmail' required: true security: - cookieAuth: [] - basicAuth: [] - jwtAuth: [] responses: '200': content: application/json: schema: $ref: '#/components/schemas/RegisteredEmail' description: '' '400': content: application/json: schema: $ref: '#/components/schemas/RegisteredEmailError' description: '' /api/accounts/reset-password/: post: operationId: accounts_reset-password description: 'Reset the password of the given user using the provided signature and timestamp. This endpoint is generally only used by an administrator to reset a user''s password. The response will be a detail message indicating if the password reset was successful. **On the command line:** ```bash blind accounts reset-password --data reset-password.json ```' summary: Reset user password tags: - accounts requestBody: content: application/json: schema: $ref: '#/components/schemas/ResetPassword' application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/ResetPassword' multipart/form-data: schema: $ref: '#/components/schemas/ResetPassword' required: true security: - cookieAuth: [] - basicAuth: [] - jwtAuth: [] - {} responses: '200': content: application/json: schema: $ref: '#/components/schemas/PasswordReset' description: '' '400': content: application/json: schema: $ref: '#/components/schemas/PasswordResetError' description: '' /api/accounts/send-reset-password-link/: post: operationId: accounts_send-reset-password-link description: 'Send a password reset link email to the user with the given email address. This endpoint does not require the user to have activated their account yet. The response will be a detail message indicating if the reset link was sent. **On the command line:** ```bash blind accounts send-reset-password-link --data ''{"email": "demo@example.com"}'' ```' summary: Send reset password link tags: - accounts requestBody: content: application/json: schema: $ref: '#/components/schemas/DefaultSendResetPasswordLink' application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/DefaultSendResetPasswordLink' multipart/form-data: schema: $ref: '#/components/schemas/DefaultSendResetPasswordLink' required: true security: - cookieAuth: [] - basicAuth: [] - jwtAuth: [] - {} responses: '200': content: application/json: schema: $ref: '#/components/schemas/ResetPasswordLinkSent' description: '' '400': content: application/json: schema: $ref: '#/components/schemas/ResetPasswordLinkSentError' description: '' /api/accounts/verify-email/: post: operationId: accounts_verify-email description: 'Verify the authenticated user''s email address. This is useful if you want to automate onboarding of users within your organization. The response will be a detail message indicating if the verification was successful. **On the command line:** ```bash blind accounts verify-email --data verification.json ```' summary: Verify user email tags: - accounts requestBody: content: application/json: schema: $ref: '#/components/schemas/VerifyEmail' application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/VerifyEmail' multipart/form-data: schema: $ref: '#/components/schemas/VerifyEmail' required: true security: - cookieAuth: [] - basicAuth: [] - jwtAuth: [] - {} responses: '200': content: application/json: schema: $ref: '#/components/schemas/VerifiedEmail' description: '' '400': content: application/json: schema: $ref: '#/components/schemas/VerifiedEmailError' description: '' /api/accounts/verify-registration/: post: operationId: accounts_verify-registration description: 'This endpoint verifies a new user with their user ID, a timestamp, and a signature. These values must come from the received verification email. The response will be a detail message indicating if the verification was successful. **On the command line:** ```bash blind accounts verify-registration --data registration.json ```' summary: Verify a new user account tags: - accounts requestBody: content: application/json: schema: $ref: '#/components/schemas/VerifyRegistration' application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/VerifyRegistration' multipart/form-data: schema: $ref: '#/components/schemas/VerifyRegistration' required: true security: - cookieAuth: [] - basicAuth: [] - jwtAuth: [] - {} responses: '200': content: application/json: schema: $ref: '#/components/schemas/AccountVerified' description: '' '400': content: application/json: schema: $ref: '#/components/schemas/AccountVerifiedError' description: '' components: schemas: OrganizationRegisterUser: type: object description: 'Overloads DefaultRegisterUserSerializer for the Blind Insight register flow. Historically this serializer also created an Organization at register time. That behavior was removed because the post-pay flow ALSO creates an org (via OrganizationCreateSerializer with stripe_session_id), which left every signup with two orgs — one orphan from registration with no Stripe settings, one "real" org post-checkout. The orphan was the target of Stripe webhook lookups by `client_reference_id`, silently diverging from the org the user actually worked in. See the A1 express-checkout PR for context. Registration now creates the User only. The Organization is created when the user lands on /organizations/create?session_id=<...> after Stripe Checkout completes, and the subscription is attached atomically there.' properties: password: type: string maxLength: 128 email: type: string format: email title: Email address maxLength: 255 id: type: string readOnly: true first_name: type: string description: First name (optional) maxLength: 150 last_name: type: string description: Last name (optional) maxLength: 150 password_confirm: type: string writeOnly: true required: - email - id - password - password_confirm Logout: type: object properties: revoke_token: type: boolean default: false LoginSuccessfulError: type: object properties: detail: type: string default: LogoutSuccessfulError: type: object properties: detail: type: string default: OrganizationUserProfile: type: object description: Oerloads DefaultUserProfileSerializer to include organization_name and organization_slug. properties: email: type: string format: email readOnly: true title: Email address id: type: string readOnly: true first_name: type: string description: First name (optional) maxLength: 150 last_name: type: string description: Last name (optional) maxLength: 150 organization_name: type: string readOnly: true description: Organization Name maxLength: 50 organization_slug: type: string readOnly: true description: Organization URL maxLength: 50 pattern: ^[-a-zA-Z0-9_]+$ url: type: string format: uri readOnly: true required: - email - id - organization_name - organization_slug - url AccountVerified: type: object properties: detail: type: string default: User verified successfully DefaultRegisterEmail: type: object description: Default serializer used for e-mail registration (e-mail change). properties: email: type: string format: email required: - email RegisteredEmailError: type: object properties: detail: type: string default: ChangePassword: type: object properties: old_password: type: string password: type: string password_confirm: type: string writeOnly: true required: - old_password - password - password_confirm VerifiedEmailError: type: object properties: detail: type: string default: VerifyRegistration: type: object properties: user_id: type: string timestamp: type: integer signature: type: string required: - signature - timestamp - user_id PasswordReset: type: object properties: detail: type: string default: Reset password successful LogoutSuccessful: type: object properties: detail: type: string default: Logout successful DefaultSendResetPasswordLink: type: object description: 'Default serializer used for sending reset password link. It will use :ref:`send-reset-password-link-serializer-use-email-setting` setting.' properties: email: type: string required: - email VerifyEmail: type: object properties: user_id: type: string email: type: string format: email timestamp: type: integer signature: type: string required: - email - signature - timestamp - user_id VerifiedEmail: type: object properties: detail: type: string default: Email verified successfully PatchedDefaultUserProfile: type: object description: 'Default serializer used for user profile. It will use these: * User fields * :ref:`user-hidden-fields-setting` setting * :ref:`user-public-fields-setting` setting * :ref:`user-editable-fields-setting` setting to automagically generate the required serializer fields.' properties: email: type: string format: email readOnly: true title: Email address id: type: string readOnly: true first_name: type: string description: First name (optional) maxLength: 150 last_name: type: string description: Last name (optional) maxLength: 150 LoginSuccessful: type: object properties: detail: type: string default: Login successful ResetPassword: type: object properties: user_id: type: string timestamp: type: integer signature: type: string password: type: string required: - password - signature - timestamp - user_id AccountVerifiedError: type: object properties: detail: type: string default: DefaultLogin: type: object description: 'Default serializer used for user login. Please keep in mind that the authentication is done by separate function defined by :ref:`login-authenticator-setting` setting. By default :ref:`login-authenticator-setting` function will use :ref:`user-login-fields-setting` setting to extract the login field from the validated serializer data either by using the ''login'' key (which is used here) or the specific login field name(s) (e.g. ''username'', ''email''). If you want different behavior, you need to override :ref:`login-authenticator-setting` in your settings.' properties: login: type: string password: type: string required: - login - password ResetPasswordLinkSent: type: object properties: detail: type: string default: Reset link sent PasswordResetError: type: object properties: detail: type: string default: DefaultUserProfile: type: object description: 'Default serializer used for user profile. It will use these: * User fields * :ref:`user-hidden-fields-setting` setting * :ref:`user-public-fields-setting` setting * :ref:`user-editable-fields-setting` setting to automagically generate the required serializer fields.' properties: email: type: string format: email readOnly: true title: Email address id: type: string readOnly: true first_name: type: string description: First name (optional) maxLength: 150 last_name: type: string description: Last name (optional) maxLength: 150 required: - email - id RegisteredEmail: type: object properties: detail: type: string default: Register email link email sent PasswordChangedError: type: object properties: detail: type: string default: PasswordChanged: type: object properties: detail: type: string default: Password changed successfully ResetPasswordLinkSentError: type: object properties: detail: type: string default: securitySchemes: basicAuth: type: http scheme: basic cookieAuth: type: apiKey in: cookie name: sessionid jwtAuth: type: http scheme: bearer bearerFormat: JWT