{
  "opencollection": "1.0.0",
  "info": {
    "name": "Logto API references Account center Experience API",
    "version": "Cloud"
  },
  "request": {
    "auth": {
      "type": "oauth2",
      "flow": "client_credentials",
      "accessTokenUrl": "/oidc/token",
      "credentials": {
        "clientId": "{{clientId}}",
        "clientSecret": "{{clientSecret}}"
      }
    }
  },
  "items": [
    {
      "info": {
        "name": "Experience",
        "type": "folder"
      },
      "items": [
        {
          "info": {
            "name": "Init new interaction",
            "type": "http"
          },
          "http": {
            "method": "PUT",
            "url": "https://[tenant_id].logto.app/api/experience",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Init a new experience interaction with the given interaction type. Any existing interaction data will be cleared."
        },
        {
          "info": {
            "name": "Update interaction event",
            "type": "http"
          },
          "http": {
            "method": "PUT",
            "url": "https://[tenant_id].logto.app/api/experience/interaction-event",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Update the current experience interaction event to the given event type. This API is used to switch the interaction event between `SignIn` and `Register`, while keeping all the verification records data."
        },
        {
          "info": {
            "name": "Identify user for the current interaction",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/identification",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "This API identifies the user based on the verificationId within the current experience interaction: <br/>- `SignIn` and `ForgotPassword` interactions: Verifies the user's identity using the provided `verificationId`. <br/>- `Register` interaction: Creates a new user account using the profile data from the current interaction. If a verificationId is provided, the profile data will first be updated with the verification record before creating the account. If not, the account is created directly fr"
        },
        {
          "info": {
            "name": "Submit interaction",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/submit"
          },
          "docs": "Submit the current interaction. <br/>- Submit the verified user identity to the OIDC provider for further authentication (SignIn and Register). <br/>- Update the user's profile data if any (SignIn and Register). <br/>- Reset the password and clear all the interaction records (ForgotPassword)."
        },
        {
          "info": {
            "name": "Get public interaction data",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://[tenant_id].logto.app/api/experience/interaction"
          },
          "docs": "Get the public interaction data."
        },
        {
          "info": {
            "name": "Create password verification record",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/verification/password",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Create and verify a new Password verification record. The verification record can only be created if the provided user credentials are correct."
        },
        {
          "info": {
            "name": "Create and send verification code",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/verification/verification-code",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Create a new `CodeVerification` record and sends the code to the specified identifier. The code verification can be used to verify the given identifier."
        },
        {
          "info": {
            "name": "Verify verification code",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/verification/verification-code/verify",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Verify the provided verification code against the user's identifier. If successful, the verification record will be marked as verified."
        },
        {
          "info": {
            "name": "Create and send MFA verification code",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/verification/mfa-verification-code",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Create a new MFA verification code and send it to the user's bound identifier (email or phone). This endpoint automatically uses the user's bound email address or phone number from their profile for MFA verification. The user must be identified before calling this endpoint."
        },
        {
          "info": {
            "name": "Verify MFA verification code",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/verification/mfa-verification-code/verify",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Verify the provided MFA verification code. The verification code must have been sent using the MFA verification code endpoint. This endpoint verifies the code against the user's bound identifier and marks the verification as complete if successful."
        },
        {
          "info": {
            "name": "Create social verification",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/verification/social/:connectorId/authorization-uri",
            "params": [
              {
                "name": "connectorId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the connector."
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Create a new SocialVerification record and return the provider's authorization URI for the given connector."
        },
        {
          "info": {
            "name": "Verify social verification",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/verification/social/:connectorId/verify",
            "params": [
              {
                "name": "connectorId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the connector."
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Verify the social authorization response data and get the user's identity data from the social provider."
        },
        {
          "info": {
            "name": "Create enterprise SSO verification",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/verification/sso/:connectorId/authorization-uri",
            "params": [
              {
                "name": "connectorId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the connector."
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Create a new EnterpriseSSO verification record and return the provider's authorization URI for the given connector."
        },
        {
          "info": {
            "name": "Verify enterprise SSO verification",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/verification/sso/:connectorId/verify",
            "params": [
              {
                "name": "connectorId",
                "value": "",
                "type": "path",
                "description": "The unique identifier of the connector."
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Verify the SSO authorization response data and get the user's identity from the SSO provider."
        },
        {
          "info": {
            "name": "Create TOTP secret",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/verification/totp/secret"
          },
          "docs": "Create a new TOTP verification record and generate a new TOTP secret for the user. This secret can be used to bind a new TOTP verification to the user's profile. The verification record must be verified before the secret can be used to bind a new TOTP verification to the user's profile."
        },
        {
          "info": {
            "name": "Verify TOTP verification",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/verification/totp/verify",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Verifies the provided TOTP code against the new created TOTP secret or the existing TOTP secret. If a verificationId is provided, this API will verify the code against the TOTP secret that is associated with the verification record. Otherwise, a new TOTP verification record will be created and verified against the user's existing TOTP secret."
        },
        {
          "info": {
            "name": "Create WebAuthn registration verification",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/verification/web-authn/registration"
          },
          "docs": "Create a new WebAuthn registration verification record. The verification record can be used to bind a new WebAuthn credential to the user's profile."
        },
        {
          "info": {
            "name": "Verify WebAuthn registration verification",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/verification/web-authn/registration/verify",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Verify the WebAuthn registration response against the user's WebAuthn registration challenge. If the response is valid, the WebAuthn registration record will be marked as verified."
        },
        {
          "info": {
            "name": "Create WebAuthn authentication verification",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/verification/web-authn/authentication"
          },
          "docs": "Create a new WebAuthn authentication verification record based on the user's existing WebAuthn credential. This verification record can be used to verify the user's WebAuthn credential."
        },
        {
          "info": {
            "name": "Verify WebAuthn authentication verification",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/verification/web-authn/authentication/verify",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Verifies the WebAuthn authentication response against the user's authentication challenge. Upon successful verification, the verification record will be marked as verified."
        },
        {
          "info": {
            "name": "Create passkey sign-in WebAuthn authentication with identifier",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/verification/sign-in-passkey/authentication",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Create WebAuthn authentication options for passkey sign-in with an identifier. The identifier is used to look up the user's WebAuthn credentials and generate non-discoverable authentication options."
        },
        {
          "info": {
            "name": "Verify passkey sign-in WebAuthn authentication",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/verification/sign-in-passkey/authentication/verify",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Verify the passkey sign-in WebAuthn authentication response against the stored authentication challenge. When `verificationId` is provided, it verifies against the challenge generated by the identifier-based authentication endpoint. When omitted, it verifies against the preflight authentication options stored in the interaction. Upon successful verification, the verification record will be marked as verified and the user will be resolved by the credential if not provided earlier."
        },
        {
          "info": {
            "name": "Generate backup codes",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/verification/backup-code/generate"
          },
          "docs": "Create a new BackupCode verification record with new backup codes generated. This verification record will be used to bind the backup codes to the user's profile."
        },
        {
          "info": {
            "name": "Verify backup code",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/verification/backup-code/verify",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Create a new BackupCode verification record and verify the provided backup code against the user's backup codes. The verification record will be marked as verified if the code is correct."
        },
        {
          "info": {
            "name": "Create new password identity verification",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/verification/new-password-identity",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Create a NewPasswordIdentity verification record for the new user registration use. The verification record includes a unique user identifier and a password that can be used to create a new user account."
        },
        {
          "info": {
            "name": "Verify one-time token",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/verification/one-time-token/verify",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Verify the provided one-time token against the user's email. If successful, the verification record will be marked as verified."
        },
        {
          "info": {
            "name": "Add user profile",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/profile",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Adds user profile data to the current experience interaction. <br/>- For `Register`: The profile data provided before the identification request will be used to create a new user account. <br/>- For `SignIn` and `Register`: The profile data provided after the user is identified will be used to update the user's profile when the interaction is submitted. <br/>- `ForgotPassword`: Not supported."
        },
        {
          "info": {
            "name": "Reset user password",
            "type": "http"
          },
          "http": {
            "method": "PUT",
            "url": "https://[tenant_id].logto.app/api/experience/profile/password",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Reset the user's password. (`ForgotPassword` interaction only)"
        },
        {
          "info": {
            "name": "Mark MFA as enabled",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/profile/mfa/mfa-enabled"
          },
          "docs": "Mark the user's MFA as enabled for the current interaction and persist in DB user configs upon successful submission."
        },
        {
          "info": {
            "name": "Skip MFA binding flow",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/profile/mfa/mfa-skipped"
          },
          "docs": "Skip MFA verification binding flow. If the MFA is enabled in the sign-in experience settings and marked as `UserControlled`, the user can skip the MFA verification binding flow by calling this API."
        },
        {
          "info": {
            "name": "Skip additional MFA suggestion",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/profile/mfa/mfa-suggestion-skipped"
          },
          "docs": "Mark the optional additional MFA binding suggestion as skipped for the current interaction. When multiple MFA factors are enabled and only an email/phone factor is configured, a suggestion to add another factor may be shown; this endpoint records the choice to skip."
        },
        {
          "info": {
            "name": "Skip passkey binding",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/profile/mfa/passkey-skipped"
          },
          "docs": "Skip passkey binding flow. The users can temporarily skip the passkey binding flow by calling this API during sign-up. On sign-in, the skip flag will be persisted to user config."
        },
        {
          "info": {
            "name": "Bind passkey for sign-in",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/profile/mfa/passkey",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Bind a WebAuthn credential as a passkey for sign-in purposes. Unlike `POST /api/experience/profile/mfa` with `type: WebAuthn`, this endpoint is exclusively for adding a passkey as a sign-in method and does NOT mark the user's optional MFA as enabled."
        },
        {
          "info": {
            "name": "Bind MFA verification by verificationId",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/profile/mfa",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Bind new MFA verification to the user profile using the verificationId."
        },
        {
          "info": {
            "name": "Get enabled SSO connectors by the given email's domain",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://[tenant_id].logto.app/api/experience/sso-connectors",
            "params": [
              {
                "name": "email",
                "value": "",
                "type": "query",
                "description": "The email address to find the enabled SSO connectors."
              }
            ]
          },
          "docs": "Extract the email domain from the provided email address. Returns all the enabled SSO connectors that match the email domain."
        },
        {
          "info": {
            "name": "Create passkey sign-in WebAuthn authentication",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://[tenant_id].logto.app/api/experience/preflight/sign-in-passkey/authentication"
          },
          "docs": "Create WebAuthn authentication options for passkey sign-in. The user will be resolved later by the credential during verification."
        }
      ]
    }
  ],
  "bundled": true
}