API REFERENCE

API reference

The public Lucion Identity API reference is generated from the deployed route inventory and the OpenAPI contract.

MACHINE-READABLE CONTRACT

OpenAPI 3.1

Use the JSON contract for tooling or download the YAML representation for review and generation workflows.

Use the grouped references below for protocol guidance, then open the OpenAPI document for exact schemas, status responses, and operation metadata. Every public route is represented in the inventory below.

Grouped reference

Runtime and readiness Authentication and recovery Organizations Developer and webhooks OAuth and OIDC SCIM

PUBLIC ROUTE INVENTORY

Every public endpoint

Runtime

GET/api/healthRead safe release and runtime status

POST/api/docs/askAsk the documentation assistant a bounded question

GET/api/v1/capabilitiesRead the safe public capability evidence matrix

GET/api/v1/readinessRead the production readiness matrix

GET/api/v1/rehearsalRead fail-closed launch rehearsal state

GET/api/v1/meRead the authenticated identity profile

GET/api/v1/me/membershipsRead the authenticated Lucion ID's own D1 organization memberships

GET/api/v1/organizationsList the bearer token's organization

GET/api/v1/organizations/{id}Read a bearer-scoped organization

GET/api/v1/organizations/{id}/membersList bearer-scoped organization members

GET/api/v1/organizations/{id}/invitationsList bearer-scoped organization invitations

GET/api/v1/organizations/{id}/groupsList bearer-scoped organization groups

GET/api/v1/organizations/{id}/groups/{group_id}/membersList bearer-scoped group members

GET/api/v1/organizations/{id}/domainsList bearer-scoped verified domains

GET/api/v1/organizations/{id}/lyra/actionsList bearer-scoped Lyra action catalog

POST/api/v1/developer/applicationsRegister an application with a scoped API key

GET/api/v1/privacy/exportExport the authenticated identity data boundary

PATCH/api/v1/meUpdate the authenticated identity profile

GET/api/openapi.jsonFetch the public machine-readable contract

GET/api/v1/developer/applicationsList owned applications with a scoped bearer credential

GET/api/v1/developer/api-keysList API-key metadata with a scoped bearer credential

GET/api/v1/developer/audit-eventsList owner-scoped activity with a scoped bearer credential

GET/api/v1/developer/webhooksList webhook subscriptions with a scoped bearer credential

GET/api/v1/developer/webhooks/deliveriesList delivery metadata with a scoped bearer credential

POST/api/v1/developer/webhooks/testDeliver a signed test event with a scoped API key

POST/api/webhooks/resendReceive signed Resend delivery events

POST/internal/integration-decisionsConsume a signed Lucion Developer certification decision

GET/internal/client-trust/{client_id}Read current application trust for a Lucion resource server

POST/mcpUse the Lucion Identity remote MCP API-key tool

Authentication

GET/api/auth/statusRead authentication capability status

GET/api/auth/passkeys/capabilitiesRead passkey and WebAuthn capabilities

GET/api/auth/password/capabilitiesRead password authentication capability and security contract

GET/api/auth/email-otp/capabilitiesRead the independent email OTP sign-in capability

GET/api/auth/verification/capabilitiesRead the verification UX contract

GET/api/auth/interaction/capabilitiesRead Trust UX capabilities

GET/api/auth/enrollment/capabilitiesRead enrollment readiness

GET/api/auth/email/capabilitiesRead email delivery status

GET/api/auth/session/capabilitiesRead session security status

GET/api/auth/recovery/capabilitiesRead recovery capabilities

GET/api/auth/authorization/capabilitiesRead authorization capabilities

GET/api/auth/federation/capabilitiesRead provider-level enterprise federation capability status

GET/api/auth/federation/discoveryDiscover a verified-domain federation connection

GET/api/auth/federation/oidc/startStart a guarded inbound OIDC authorization-code transaction

GET/api/auth/federation/oidc/callbackComplete a single-use inbound OIDC transaction

GET/api/auth/privacy/deletion-requestRead the current account deletion-request state

POST/api/auth/privacy/deletion-requestRequest account deletion for manual privacy review

POST/api/auth/privacy/deletion-request/cancelCancel a pending account deletion request

POST/api/auth/enrollment/startStart verified-email enrollment

POST/api/auth/enrollment/verify-emailVerify the six-digit email code

POST/api/auth/enrollment/resend-emailRequest a replacement verification email

POST/api/auth/enrollment/password/completeCreate an account with verified email and password

POST/api/auth/enrollment/passkey/optionsIssue registration options

POST/api/auth/enrollment/passkey/completeVerify and persist a passkey

POST/api/auth/signin/passkey/optionsIssue a passkey sign-in challenge

POST/api/auth/signin/passkey/completeVerify an assertion and issue a session

POST/api/auth/signin/passwordVerify a password and issue a session

POST/api/auth/signin/email-otp/startRequest a short-lived email sign-in code

POST/api/auth/signin/email-otp/completeVerify a single-use email code and issue a session

GET/api/auth/sessionResolve the current session

GET/api/auth/oauth/connectionsList this Lucion ID's active OAuth connections

DELETE/api/auth/oauth/connections/{connection_id}Disconnect one owned OAuth or assistant connection

GET/api/auth/sessionsList active sessions

POST/api/auth/sessions/revokeRevoke one owned session

POST/api/auth/signoutRevoke the current session

POST/api/auth/step-up/passkey/optionsIssue a step-up challenge

POST/api/auth/step-up/passkey/completeComplete passkey step-up

POST/api/auth/step-up/passwordComplete password re-authentication step-up

POST/api/auth/password/setSet or rotate a password credential

POST/api/auth/recovery/startStart recovery proof

POST/api/auth/recovery/resendResend a recovery code

POST/api/auth/recovery/verifyVerify recovery proof without a session

POST/api/auth/recovery/passkey/optionsIssue replacement-passkey options

POST/api/auth/recovery/passkey/completeComplete replacement-passkey recovery

GET/api/auth/organizationsList session organizations

GET/api/auth/membershipsRead the authenticated Lucion ID's own D1 organization memberships

POST/api/auth/authorization/evaluateEvaluate organization permission

POST/api/auth/lyra/evaluateEvaluate scope-bound Lyra delegation

POST/api/auth/lyra/respondRequest a bounded Groq-backed Lyra advisory response

POST/api/auth/lyra/actions/executeSubmit a confirmed, delegated Lyra action boundary request

Organizations

GET/api/organizations/{id}/federation/connections/{connection_id}/healthRun a read-only provider metadata preflight

GET/api/organizationsList organizations for the session

POST/api/organizationsCreate an organization

GET/api/organizations/{id}Read an organization

PATCH/api/organizations/{id}Update organization settings

GET/api/organizations/{id}/membersList tenant-bound members

PATCH/api/organizations/{id}/members/{member_id}Update a member role or status

DELETE/api/organizations/{id}/members/{member_id}Revoke a membership without deleting the user

GET/api/organizations/{id}/invitationsList tenant-bound invitations

POST/api/organizations/{id}/invitationsCreate an organization invitation

POST/api/organizations/{id}/invitations/{invitation_id}Resend an organization invitation

DELETE/api/organizations/{id}/invitations/{invitation_id}Revoke an organization invitation

POST/api/organizations/invitations/acceptAccept an invitation

GET/api/organizations/{id}/delegated-adminsList delegated administrator grants

POST/api/organizations/{id}/delegated-adminsCreate a scoped delegated administrator grant

DELETE/api/organizations/{id}/delegated-admins/{delegation_id}Revoke a delegated administrator grant

GET/api/organizations/{id}/policiesList organization policies

POST/api/organizations/{id}/policiesCreate or update a policy, including optional session binding

PATCH/api/organizations/{id}/policiesUpdate a policy, including optional session binding

DELETE/api/organizations/{id}/policies/{policy_key}Remove a policy and restore the default boundary

GET/api/organizations/{id}/groupsList organization groups

POST/api/organizations/{id}/groupsCreate an organization group

PATCH/api/organizations/{id}/groups/{group_id}Rename an organization group

DELETE/api/organizations/{id}/groups/{group_id}Delete an empty organization group

GET/api/organizations/{id}/groups/{group_id}/membersList group members

POST/api/organizations/{id}/groups/{group_id}/membersAdd a member to a group

DELETE/api/organizations/{id}/groups/{group_id}/members/{membership_id}Remove a member from a group

GET/api/organizations/{id}/rolesList roles and permissions

POST/api/organizations/{id}/rolesCreate a custom role

PATCH/api/organizations/{id}/roles/{role_id}Update a custom role

DELETE/api/organizations/{id}/roles/{role_id}Delete an unused custom role

GET/api/organizations/{id}/applicationsList application assignments

POST/api/organizations/{id}/applicationsAssign an application

DELETE/api/organizations/{id}/applications/{application_id}Disable an application assignment

GET/api/organizations/{id}/domainsList organization domains

POST/api/organizations/{id}/domainsRegister a DNS-verifiable domain

DELETE/api/organizations/{id}/domains/{domain_id}Delete a domain record with active-federation protection

POST/api/organizations/{id}/domains/{domain_id}/verifyVerify a DNS TXT domain proof

GET/api/organizations/{id}/federation/connectionsList organization federation metadata

POST/api/organizations/{id}/federation/connectionsRegister federation metadata

PATCH/api/organizations/{id}/federation/connections/{connection_id}Activate or disable federation metadata after bounded provider validation

DELETE/api/organizations/{id}/federation/connections/{connection_id}Delete a disabled federation connection

GET/api/organizations/{id}/lyra/actionsList schema-validated Lyra action catalog entries

POST/api/organizations/{id}/lyra/actionsRegister a schema-validated Lyra action

GET/api/organizations/{id}/audit-eventsList tenant-bound audit events

GET/api/organizations/{id}/approvalsList approval requests

POST/api/organizations/{id}/approvalsCreate an approval request

POST/api/organizations/{id}/approvals/{approval_id}Approve or reject a request with independent admin step-up

Developer

GET/api/developer/applicationsList owned applications

POST/api/developer/applicationsRegister an application

PATCH/api/developer/applications/{application_id}Edit application metadata, exact redirects, or scopes

DELETE/api/developer/applications/{application_id}Disable application and revoke its credentials and grants

POST/api/developer/applications/{application_id}/rotate-secretRotate a confidential OIDC client secret

GET/api/developer/applications/{application_id}/certification/statusRead the owned app certification status and approved scopes

GET/api/developer/api-keysList API-key metadata

POST/api/developer/api-keysCreate a one-time API key

GET/api/developer/audit-eventsList owner-scoped activity

POST/api/developer/api-keys/revokeRevoke an owned API key

GET/api/developer/webhooksList webhook subscriptions

POST/api/developer/webhooksCreate a signed webhook subscription

GET/api/developer/webhooks/deliveriesList delivery metadata

POST/api/developer/webhooks/testDeliver a signed test event

POST/api/developer/webhooks/deliveries/processQueue due deliveries

POST/api/developer/webhooks/deliveries/retryRetry an owned delivery

POST/api/developer/webhooks/rotateRotate a signing secret

POST/api/developer/webhooks/disableDisable a webhook subscription

OAuth / OIDC

POST/oauth/authorizeIssue an authorization code

GET/oauth/authorize/contextValidate an OAuth consent request before rendering

POST/oauth/registerRegister a public OAuth client for a remote MCP connector

POST/oauth/tokenExchange a code or refresh token

GET/oauth/userinfoReturn scoped OIDC claims

POST/oauth/revokeRevoke an OAuth token and its refresh-token family

GET/.well-known/oauth-protected-resource/mcpRead protected-resource metadata for the MCP server

GET/.well-known/openid-configurationRead OIDC discovery metadata

GET/.well-known/oauth-authorization-serverRead OAuth metadata

GET/.well-known/jwks.jsonRead public OIDC signing keys

SCIM

GET/scim/v2/UsersList active organization users

POST/scim/v2/UsersProvision an organization user

GET/scim/v2/Users/{id}Read a SCIM user

PUT/scim/v2/Users/{id}Replace a SCIM user

PATCH/scim/v2/Users/{id}Patch a SCIM user

DELETE/scim/v2/Users/{id}Deprovision a SCIM user

GET/scim/v2/ServiceProviderConfigRead SCIM service capabilities

GET/scim/v2/ResourceTypesRead SCIM resource metadata

GET/scim/v2/Schemas/{id}Read a SCIM resource schema

GET/scim/v2/GroupsList organization groups

POST/scim/v2/GroupsProvision an organization group

GET/scim/v2/Groups/{id}Read an organization group

PUT/scim/v2/Groups/{id}Replace an organization group

PATCH/scim/v2/Groups/{id}Patch an organization group

DELETE/scim/v2/Groups/{id}Deprovision an organization group