Sign-up and sign-in

Signs a member in and returns their tokens.

Api-Key headeranonymous token

Limited per account rather than per address. Websites call this from their own server, so every member of a tenant signs in from one address — limiting on that would throttle the tenant and still leave a botnet free to spray a single account.

Credentials are checked by the authentication server, not here, so this bounds attemptsat the front door. Account lockout belongs on that server, where a wrong password isactually known to be wrong. Takes an email and password, nothing else. The OAuth client id and secret usedto exchange them for a token belong to the tenant, so they are resolved here rather thansent by the caller.

Request body · application/json · UserLoginRequest

Responses

Registers a new member account.

Api-Key headeranonymous token

Anonymous. No sign-in, but this shared host cannot tell which auction house you mean, so it needs a tenant token from POST /v1/tokens/anonymous. Always send Api-Key as well.

Request body · application/json · MemberAddDto

Responses

HttpGet! Forgot My Password method

Api-Key headeranonymous token

Limited per address so nobody can be mail-bombed by repeated resets on an account they own but the caller does not.

Request body · application/json · ForgotPasswordRequest

Responses

Sets a new password using the token from a reset email.

Api-Key headeranonymous token

Anonymous. No sign-in, but this shared host cannot tell which auction house you mean, so it needs a tenant token from POST /v1/tokens/anonymous. Always send Api-Key as well.

Request body · application/json · CreateNewPasswordRequest

Responses

Confirms a registration using the key emailed to the member.

Api-Key headeranonymous token

Anonymous. No sign-in, but this shared host cannot tell which auction house you mean, so it needs a tenant token from POST /v1/tokens/anonymous. Always send Api-Key as well.

Request body · application/json · ValidateKeyRequest

Responses

Sends a verification code by SMS.

Api-Key headeranonymous token

The tightest limit of the four: every send bills MessageBird and rings a real phone, so an unbounded caller costs money and harasses whoever owns the number.

Request body · application/json · SendSmsCodeRequest

Responses

Confirms a phone number with the code that was sent to it.

Api-Key headeranonymous token

A six-digit code falls to a few hundred thousand guesses, which is minutes of unbounded requests. Bounding the attempts is what makes it a second factor.

Request body · application/json · ValidateSmsCodeRequest

Responses

Sends the registration confirmation email again.

Api-Key headeranonymous token

Anonymous. No sign-in, but this shared host cannot tell which auction house you mean, so it needs a tenant token from POST /v1/tokens/anonymous. Always send Api-Key as well.

Request body · application/json · ResendEmailRequest

Responses

Checks whether an email address or VAT number is already registered, before submitting a registration.

Api-Key headeranonymous token

Bound from the query string. Without [FromQuery] an [ApiController] binds a complex parameter from the body, which a GET has none of — the endpoint answered 415 to every caller.

Parameters

Responses