upzero
Get startedGuidesCLIAPI
Endpoints

Authentication

Get Current User Profile

GET/api/v1/auth/me

Get current authenticated user profile.

Returns user information with counts of active sessions and devices.

Requires: Valid JWT token in Authorization header

Authorization

HTTPBearer
AuthorizationBearer <token>

In: header

Response Body

application/json

curl -X GET "https://example.com/api/v1/auth/me"
{  "email": "string",  "email_verified": false,  "name": "string",  "given_name": "string",  "family_name": "string",  "avatar_url": "string",  "locale": "string",  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",  "zitadel_id": "string",  "created_at": "2019-08-24T14:15:22Z",  "updated_at": "2019-08-24T14:15:22Z",  "last_login_at": "2019-08-24T14:15:22Z",  "active_sessions_count": 0,  "active_devices_count": 0}

Update User Profile

PATCH/api/v1/auth/profile

Update current user's profile.

Editable fields (name, given/family name, locale) are written through to Zitadel (the identity source of truth) and then mirrored locally. Email and zitadel_id cannot be changed. Avatars are set via POST /auth/profile/avatar, not here.

Requires: Valid JWT token in Authorization header

Authorization

HTTPBearer
AuthorizationBearer <token>

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Schema for updating user profile.

Response Body

application/json

application/json

curl -X PATCH "https://example.com/api/v1/auth/profile" \  -H "Content-Type: application/json" \  -d '{}'
{  "email": "string",  "email_verified": false,  "name": "string",  "given_name": "string",  "family_name": "string",  "avatar_url": "string",  "locale": "string",  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",  "zitadel_id": "string",  "created_at": "2019-08-24T14:15:22Z",  "updated_at": "2019-08-24T14:15:22Z",  "last_login_at": "2019-08-24T14:15:22Z"}

Upload Avatar

POST/api/v1/auth/profile/avatar

Upload the current user's avatar image.

The image is forwarded to Zitadel's user-avatar API (Assets API) using the caller's own access token, so Zitadel stores it against this user. The resulting avatar URL (the picture claim) is then mirrored onto the local user row and returned.

Requires: Valid JWT token in Authorization header

Authorization

HTTPBearer
AuthorizationBearer <token>

In: header

Request Body

multipart/form-data

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

curl -X POST "https://example.com/api/v1/auth/profile/avatar" \  -F file="string"
{  "email": "string",  "email_verified": false,  "name": "string",  "given_name": "string",  "family_name": "string",  "avatar_url": "string",  "locale": "string",  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",  "zitadel_id": "string",  "created_at": "2019-08-24T14:15:22Z",  "updated_at": "2019-08-24T14:15:22Z",  "last_login_at": "2019-08-24T14:15:22Z"}

Logout

POST/api/v1/auth/logout

Logout current user.

Revokes current session in database. Client should also revoke token with Zitadel and clear local storage.

Requires: Valid JWT token in Authorization header

Authorization

HTTPBearer
AuthorizationBearer <token>

In: header

Response Body

application/json

curl -X POST "https://example.com/api/v1/auth/logout"
null

List User Sessions

GET/api/v1/auth/sessions

List current user's active sessions.

Returns all non-revoked, non-expired sessions.

Requires: Valid JWT token in Authorization header

Authorization

HTTPBearer
AuthorizationBearer <token>

In: header

Response Body

application/json

curl -X GET "https://example.com/api/v1/auth/sessions"
[  {    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",    "user_id": "a169451c-8525-4352-b8ca-070dd449a1a5",    "zitadel_session_id": "string",    "device_info": {},    "created_at": "2019-08-24T14:15:22Z",    "expires_at": "2019-08-24T14:15:22Z",    "revoked_at": "2019-08-24T14:15:22Z"  }]

Revoke Session

DELETE/api/v1/auth/sessions/{session_id}

Revoke a specific session.

Useful for "logout from other devices" functionality.

Requires: Valid JWT token in Authorization header

Authorization

HTTPBearer
AuthorizationBearer <token>

In: header

Path Parameters

session_id*Session Id
Formatuuid

Response Body

application/json

curl -X DELETE "https://example.com/api/v1/auth/sessions/497f6eca-6276-4993-bfeb-53cbbbba6f08"
Empty

List User Devices

GET/api/v1/auth/devices

List current user's registered devices.

Returns only active devices.

Requires: Valid JWT token in Authorization header

Authorization

HTTPBearer
AuthorizationBearer <token>

In: header

Response Body

application/json

curl -X GET "https://example.com/api/v1/auth/devices"
[  {    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",    "user_id": "a169451c-8525-4352-b8ca-070dd449a1a5",    "push_token": "string",    "platform": "string",    "device_name": "string",    "device_info": {},    "is_active": true,    "created_at": "2019-08-24T14:15:22Z",    "updated_at": "2019-08-24T14:15:22Z",    "last_used_at": "2019-08-24T14:15:22Z"  }]

Register Device

POST/api/v1/auth/devices

Register device for push notifications.

Deactivates any existing device with the same push token.

Requires: Valid JWT token in Authorization header

Authorization

HTTPBearer
AuthorizationBearer <token>

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Schema for registering a device.

Response Body

application/json

application/json

curl -X POST "https://example.com/api/v1/auth/devices" \  -H "Content-Type: application/json" \  -d '{    "push_token": "string",    "platform": "string"  }'
{  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",  "user_id": "a169451c-8525-4352-b8ca-070dd449a1a5",  "push_token": "string",  "platform": "string",  "device_name": "string",  "device_info": {},  "is_active": true,  "created_at": "2019-08-24T14:15:22Z",  "updated_at": "2019-08-24T14:15:22Z",  "last_used_at": "2019-08-24T14:15:22Z"}

Deactivate Device

DELETE/api/v1/auth/devices/{device_id}

Deactivate a device.

Device will no longer receive push notifications.

Requires: Valid JWT token in Authorization header

Authorization

HTTPBearer
AuthorizationBearer <token>

In: header

Path Parameters

device_id*Device Id
Formatuuid

Response Body

application/json

curl -X DELETE "https://example.com/api/v1/auth/devices/497f6eca-6276-4993-bfeb-53cbbbba6f08"
Empty

Auth Health Check

GET/api/v1/auth/health

Check authentication system health.

Tests connectivity to Zitadel JWKS endpoint.

Response Body

application/json

curl -X GET "https://example.com/api/v1/auth/health"
null

Refresh Token

POST/api/v1/auth/refresh

Refresh an access token using a refresh token.

Proxies the request to the Zitadel token endpoint. Returns a new access token (and rotated refresh token if configured).

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request body for token refresh.

Response Body

application/json

application/json

curl -X POST "https://example.com/api/v1/auth/refresh" \  -H "Content-Type: application/json" \  -d '{    "refresh_token": "string"  }'
{  "access_token": "string",  "refresh_token": "string",  "expires_in": 0,  "token_type": "Bearer"}

Audit trail

Previous Page

Billing

Next Page