PublicIngress

Operations of the App Runtime API. Paths are relative to your deployment's API host.

POST /api/app-platform-api/public/apps/{appSlug}/auth/anon

Create an anonymous external-subject session. Returns a delegated session JWT; every call creates a fresh subject identity.

Authentication: none

Request body: application/json AnonAuthDto

POST /api/app-platform-api/public/apps/{appSlug}/auth/magic-link/request

Request a magic-link for the given email. Creates a one-time token valid for 15 minutes and queues an email delivery event.

Authentication: none

Request body: application/json RequestMagicLinkDto

POST /api/app-platform-api/public/apps/{appSlug}/auth/magic-link/verify

Verify a magic-link token and mint a delegated session JWT. The token is single-use and expires after 15 minutes.

Authentication: none

Request body: application/json VerifyMagicLinkDto

POST /api/app-platform-api/public/apps/{appSlug}/auth/oidc

Authenticate an external subject via OIDC id_token and mint a delegated session JWT.

Authentication: none

Request body: application/json OidcAuthDto

POST /api/app-platform-api/public/apps/{appSlug}/sessions

Open a delegated session for an external-subject or public-anon audience. Returns a short-lived JWT the caller presents to the capability gateway.

Authentication: none

Request body: application/json CreatePublicSessionDto

GET /api/app-platform-api/public/sessions/{id}

Get a delegated session's metadata and status. Requires that session's own access token as the bearer.

Authentication: bearer token (Authorization: Bearer <token>)

POST /api/app-platform-api/public/sessions/{id}/revoke

Revoke a delegated session (self-sign-out). Requires that session's own access token as the bearer.

Authentication: bearer token (Authorization: Bearer <token>)