{"api_groups":{"admin":{"auth_required":"true","description":"Administrative operations — JWKS rotation, circuit breakers, email config, password policy.","permission":"admin.*","prefix":"/admin"},"api_keys":{"auth_required":"true","description":"Create and manage API keys for service-to-service authentication.","permission":null,"prefix":"/api-keys"},"authentication":{"auth_required":"false","description":"Login, register, logout, token refresh, password reset.","permission":null,"prefix":"/auth"},"delegation":{"auth_required":"true","description":"Grant scoped delegation for impersonation and acting-on-behalf.","permission":null,"prefix":"/delegation"},"events":{"auth_required":"mixed","description":"Webhook subscriptions for auth events (login, permission changes, etc.).","permission":null,"prefix":"/events"},"federation":{"auth_required":"true","description":"SAML SSO, single logout, JIT provisioning, attribute mapping.","permission":null,"prefix":"/federation"},"forward_auth":{"auth_required":"shared_secret","description":"Token validation endpoint for reverse proxies (Traefik ForwardAuth).","permission":null,"prefix":"/forward-auth"},"network_policy":{"auth_required":"true","description":"IP allowlisting, geo-fencing, network access control.","permission":null,"prefix":"/network-policy"},"organizations":{"auth_required":"true","description":"Create and manage organizations, invite users, configure settings.","permission":null,"prefix":"/organizations"},"permissions":{"auth_required":"mixed","description":"Permission checking, granting, revoking. Role and registry management.","permission":null,"prefix":"/permissions"},"providers":{"auth_required":"mixed","description":"Configure OAuth/SSO providers (Google, Okta, Auth0, Cognito, Keycloak).","permission":null,"prefix":"/providers"},"saml":{"auth_required":"mixed","description":"SAML IdP endpoints — SSO, SLO, metadata, SP management.","permission":null,"prefix":"/saml"},"teams":{"auth_required":"true","description":"Team management within organizations.","permission":null,"prefix":"/teams"},"users":{"auth_required":"true","description":"User profile management, password changes, email verification.","permission":null,"prefix":"/users"},"zanzibar":{"auth_required":"true","description":"Google Zanzibar-style relationship-based access control.","permission":null,"prefix":"/zanzibar"}},"auth_methods":{"api_key":{"headers":["Authorization: ab0t_sk_...","X-API-Key: ab0t_sk_..."],"obtain":"POST https://auth.service.ab0t.com/api-keys/","prefix":"ab0t_sk_","type":"API Key"},"bearer_token":{"algorithm":"RS256","header":"Authorization: Bearer {token}","obtain":"POST https://auth.service.ab0t.com/auth/login","refresh":"POST https://auth.service.ab0t.com/auth/refresh","ttl_minutes":15,"type":"JWT"},"oauth2":{"authorization_endpoint":"https://auth.service.ab0t.com/auth/authorize","discovery":"https://auth.service.ab0t.com/.well-known/openid-configuration","token_endpoint":"https://auth.service.ab0t.com/auth/oauth/token","type":"OAuth 2.1 + PKCE"}},"capabilities":["authentication","authorization","identity_management","organization_management","permission_mesh","oauth2.1_provider","saml_idp","forward_auth_proxy","api_key_management","zanzibar_relationship_auth"],"description":"Authentication, authorization, and identity mesh network for multi-tenant services.","discovery":{"available_roles":"https://auth.service.ab0t.com/permissions/roles","event_types":"https://auth.service.ab0t.com/events/types","health":"https://auth.service.ab0t.com/health","help":"https://auth.service.ab0t.com/help","help_enterprise":"https://auth.service.ab0t.com/help/enterprise","jwks":"https://auth.service.ab0t.com/.well-known/jwks.json","oauth_metadata":"https://auth.service.ab0t.com/.well-known/oauth-authorization-server","oidc":"https://auth.service.ab0t.com/.well-known/openid-configuration","openapi":"https://auth.service.ab0t.com/openapi.json","permission_registry":"https://auth.service.ab0t.com/permissions/registry/services","quota_tiers":"https://auth.service.ab0t.com/quotas/tiers","saml_metadata":"https://auth.service.ab0t.com/saml/metadata","status":"https://auth.service.ab0t.com/status","supported_providers":"https://auth.service.ab0t.com/providers/types/supported"},"discovery_version":"1","mesh_network":{"api_consumers_directory":{"description":"Public directory of mesh providers that opened self-serve consumption (run 08) — discover a provider, its register_url, and what each tier grants, then self-register + mint a scoped key.","detail":"GET https://auth.service.ab0t.com/mesh/providers/{service_id}","list":"GET https://auth.service.ab0t.com/mesh/providers","publish":"POST https://auth.service.ab0t.com/mesh/providers"},"description":"Each organization on the mesh gets its own auth namespace — a complete white-label authentication and authorization API scoped to their users, providers, and permissions.","how_it_works":"Create an organization, configure it, and your org becomes a live auth provider at https://auth.service.ab0t.com/organizations/{org_slug}/auth/*","onboarding_journey":[{"action":"Create organization","endpoint":"POST https://auth.service.ab0t.com/organizations/","result":null,"returns":"org_id, org_slug","step":1},{"action":"Configure branded login","endpoint":"PUT https://auth.service.ab0t.com/organizations/{org_id}/login-config","result":null,"returns":null,"step":2},{"action":"Add auth providers (Google, SAML, etc.)","endpoint":"POST https://auth.service.ab0t.com/providers/","result":null,"returns":null,"step":3},{"action":"Register OAuth clients for your apps","endpoint":"POST https://auth.service.ab0t.com/auth/oauth/register","result":null,"returns":null,"step":4},{"action":"Customize email templates","endpoint":"PUT https://auth.service.ab0t.com/organizations/{org_id}/emails/templates/{type}","result":null,"returns":null,"step":5},{"action":"Define your permission scopes","endpoint":"POST https://auth.service.ab0t.com/permissions/registry/register","result":null,"returns":null,"step":6},{"action":"Invite users to your organization","endpoint":"POST https://auth.service.ab0t.com/organizations/{org_id}/invite","result":null,"returns":null,"step":7},{"action":"Go live","endpoint":null,"result":"https://auth.service.ab0t.com/login/{org_slug} serves your branded login, https://auth.service.ab0t.com/organizations/{org_slug}/auth/* is your API","returns":null,"step":8}],"org_management":{"base":"/organizations/{org_id}","description":"Admin endpoints for configuring the organization (requires org admin token).","endpoints":{"clients":"GET https://auth.service.ab0t.com/organizations/{org_id}/clients","email_templates":"GET https://auth.service.ab0t.com/organizations/{org_id}/emails/templates","invitations":"GET https://auth.service.ab0t.com/organizations/{org_id}/invitations","jwks":"GET https://auth.service.ab0t.com/organizations/{org_id}/.well-known/jwks.json","login_config":"PUT https://auth.service.ab0t.com/organizations/{org_id}/login-config","sessions":"GET https://auth.service.ab0t.com/organizations/{org_id}/sessions","teams":"GET https://auth.service.ab0t.com/organizations/{org_id}/teams","users":"GET https://auth.service.ab0t.com/organizations/{org_id}/users"}},"org_namespace":{"base":"/organizations/{org_slug}","description":"Every organization gets these endpoints under its slug.","endpoints":{"hosted_login":"GET https://auth.service.ab0t.com/login/{org_slug}","login":"POST https://auth.service.ab0t.com/organizations/{org_slug}/auth/login","logout":"POST https://auth.service.ab0t.com/organizations/{org_slug}/auth/logout","providers":"GET https://auth.service.ab0t.com/organizations/{org_slug}/auth/providers","public_config":"GET https://auth.service.ab0t.com/organizations/{org_slug}/login-config/public","refresh":"POST https://auth.service.ab0t.com/organizations/{org_slug}/auth/refresh","register":"POST https://auth.service.ab0t.com/organizations/{org_slug}/auth/register","reset_password":"POST https://auth.service.ab0t.com/organizations/{org_slug}/auth/reset-password","sso_callback":"POST https://auth.service.ab0t.com/organizations/{org_slug}/auth/sso/callback","sso_initiate":"GET https://auth.service.ab0t.com/organizations/{org_slug}/auth/sso/initiate","token":"POST https://auth.service.ab0t.com/organizations/{org_slug}/auth/token"}}},"resources":{"common_intents":{"Add auth to my app":"https://auth.service.ab0t.com/help","Add auth to my backend service":"GET https://auth.service.ab0t.com/forward-auth/live — see service_developer in start_here","Add hosted login to my browser app":"\u003cscript src=\"https://auth.service.ab0t.com/login/_static/authmesh.global.js\"\u003e\u003c/script\u003e → window.AuthMesh — see @authmesh/sdk in resources.sdks and the guide at https://auth.service.ab0t.com/login/_static/guides/CLIENT_HOSTED_LOGIN_INTEGRATION.md","Check if a user has a permission":"POST https://auth.service.ab0t.com/permissions/check","Create a branded login page":"PUT https://auth.service.ab0t.com/organizations/{org_id}/login-config","Drop auth widgets into my page":"authmesh-widgets (get.tool.ab0t.com) — see resources.sdks and the authmesh-widgets skill","Get webhook notifications for auth events":"POST https://auth.service.ab0t.com/events/subscriptions","Issue API keys for my service":"POST https://auth.service.ab0t.com/api-keys/","See what this service can do":"GET https://auth.service.ab0t.com/","Set up SSO for my company":"https://auth.service.ab0t.com/help/enterprise — see SAML / SSO section","Set up fine-grained access control":"POST https://auth.service.ab0t.com/zanzibar/stores/{store_id}/check — see Zanzibar in api_groups","Validate a token from another service":"POST https://auth.service.ab0t.com/auth/validate-token","Which JS SDK do I use":"Read the SDK selector guide: https://auth.service.ab0t.com/login/_static/guides/WHICH_SDK.md — @authmesh/sdk (browser hosted-login bundle, window.AuthMesh.AuthMeshClient), authmesh-widgets (drop-in UI, window.AuthMeshWidgets), @auth-service/sdk (Node/npm). Full walkthrough: https://auth.service.ab0t.com/login/_static/guides/CLIENT_HOSTED_LOGIN_INTEGRATION.md"},"guides":[{"description":"Public decision guide for picking the right ab0t auth client: @authmesh/sdk (browser hosted-login bundle, window.AuthMesh), authmesh-widgets (drop-in UI components, window.AuthMeshWidgets), @auth-service/sdk (Node/JS backend), and the server-side language SDKs (Python auth_wrapper, Go). Includes 'use this when…' guidance and the correct constructor calls.","name":"Which JS SDK Do I Use","url":"https://auth.service.ab0t.com/login/_static/guides/WHICH_SDK.md"},{"description":"Step-by-step SOP for a client to add hosted login to a browser app: which SDK (@authmesh/sdk browser bundle), the \u003cscript\u003e URL to load, window.AuthMesh usage, the drop-in widget option (authmesh-widgets), and where the TypeScript types live.","name":"Client Hosted Login Integration","url":"https://auth.service.ab0t.com/login/_static/guides/CLIENT_HOSTED_LOGIN_INTEGRATION.md"},{"description":"Human-readable guide for org admins: create org, configure SSO, manage teams, set up permissions.","name":"Enterprise Quick Start","url":"https://auth.service.ab0t.com/help/enterprise"},{"description":"Human-readable guide for end users: register, login, manage profile, switch workspaces.","name":"Individual Quick Start","url":"https://auth.service.ab0t.com/help"},{"description":"Full machine-readable API spec with request/response schemas for every endpoint.","name":"OpenAPI Specification","url":"https://auth.service.ab0t.com/openapi.json"}],"sdks":[{"description":"Python SDK for Auth Service API — token validation, permission checking, FastAPI middleware integration, and service-to-service auth.","install":"pip install auth_wrapper","name":"auth_wrapper","repository":"https://github.com/ab0t-com/auth_wrapper"},{"description":"Browser hosted-login SDK (window.AuthMesh) — OAuth 2.1 + PKCE, org-scoped login, and session management. This is the bundle a hosted-login client actually loads. Load it with: \u003cscript src=\"https://auth.service.ab0t.com/login/_static/authmesh.global.js\"\u003e\u003c/script\u003e then use window.AuthMesh. Version manifest (name/version/sha256): https://auth.service.ab0t.com/login/_static/authmesh.version.json. TypeScript types ship beside the build (dist/index.d.ts). See the Client Hosted Login Integration guide in resources.guides.","install":"\u003cscript src=\"https://auth.service.ab0t.com/login/_static/authmesh.global.js\"\u003e\u003c/script\u003e","name":"@authmesh/sdk","repository":"https://auth.service.ab0t.com/login/_static/authmesh.global.js"},{"description":"Standalone JavaScript/TypeScript SDK (npm package) for Node.js and browser — token validation, permission checks, and an OAuth 2.1 + PKCE client. Distinct from @authmesh/sdk (the hosted-login browser bundle). Types ship as .d.ts with the package. Not yet published to a public npm registry — contact ab0t for access.","install":"npm install @auth-service/sdk","name":"@auth-service/sdk","repository":null},{"description":"Public embeddable Auth Mesh widget library — drop-in browser web components (login, signup, API key, user menu, org switcher, invite, usage). Self-contained JS distributed via reg (get.tool.ab0t.com). Embed the components directly in your host page.","install":"reg install authmesh-widgets  # from get.tool.ab0t.com","name":"authmesh-widgets","repository":null}],"skills":[{"description":"Integrate ab0t-auth into a FastAPI microservice. Covers permission design, .permissions.json, AuthGuard middleware, route protection, and testing.","name":"auth_fastapi_skill","usage":"Download the skill folder and provide it to your LLM as context when building a new FastAPI service that needs auth."},{"description":"Set up hosted login for a frontend app. Covers org-scoped auth endpoints, @authmesh/sdk wiring, login config branding, and redirect flows. Supports both BYOUI (custom login form) and SDK-based (OAuth code flow with redirects) patterns.","name":"hosted_login_skill","usage":"Download the skill folder and provide it to your LLM as context when integrating a frontend with the hosted login portal."},{"description":"Onboard any service to the ab0t Auth Mesh. Covers the setup CLI and numbered scripts (01-07): permission design, OAuth client registration, hosted login branding, default team setup, Zanzibar permission model, and consumer registration.","name":"auth-mesh-setup","usage":"Download the skill folder and provide it to your LLM as context when registering a new service with the auth mesh."},{"description":"Register services as consumers of other services in the auth mesh. Covers cross-service API keys, consumer sub-orgs, clients.d config, register-as-client.sh, X-API-Key header wiring, and proxy routes.","name":"mesh-service-accounts","usage":"Download the skill folder and provide it to your LLM as context when setting up service-to-service authentication."}]},"service":"ab0t-auth","start_here":{"individual_user":{"description":"Sign up, log in, manage your profile and workspaces.","guide":"https://auth.service.ab0t.com/help","login":"POST https://auth.service.ab0t.com/auth/login","profile":"GET https://auth.service.ab0t.com/users/me","register":"POST https://auth.service.ab0t.com/auth/register"},"machine_or_agent":{"description":"Programmatic discovery for services and AI agents.","jwks":"https://auth.service.ab0t.com/.well-known/jwks.json","oidc_discovery":"https://auth.service.ab0t.com/.well-known/openid-configuration","openapi":"https://auth.service.ab0t.com/openapi.json","permission_check":"POST https://auth.service.ab0t.com/permissions/check","zanzibar_check":"POST https://auth.service.ab0t.com/zanzibar/stores/{store_id}/check"},"org_end_user":{"description":"You were invited to an organization. Sign up and use their auth.","hosted_login":"https://auth.service.ab0t.com/login/{org_slug}","login":"POST https://auth.service.ab0t.com/organizations/{org_slug}/auth/login","register":"POST https://auth.service.ab0t.com/organizations/{org_slug}/auth/register","see_providers":"GET https://auth.service.ab0t.com/organizations/{org_slug}/auth/providers"},"organization_admin":{"description":"Create an org that becomes its own auth provider on the mesh — with branded login, SSO, custom permissions, and a complete user-facing auth API.","guide":"https://auth.service.ab0t.com/help/enterprise","quick_start":["POST https://auth.service.ab0t.com/organizations/ → create your org","PUT https://auth.service.ab0t.com/organizations/{org_id}/login-config → brand your login","POST https://auth.service.ab0t.com/providers/ → add Google/SAML/Okta","POST https://auth.service.ab0t.com/organizations/{org_id}/invite → invite your users","https://auth.service.ab0t.com/login/{org_slug} → your users sign in here"],"your_hosted_login":"https://auth.service.ab0t.com/login/{org_slug}","your_jwks":"https://auth.service.ab0t.com/organizations/{org_id}/.well-known/jwks.json","your_namespace":"https://auth.service.ab0t.com/organizations/{org_slug}/auth/*"},"service_developer":{"create_api_key":"POST https://auth.service.ab0t.com/api-keys/","description":"Integrate your service with auth — validate tokens, enforce permissions, use forward-auth.","forward_auth":"GET https://auth.service.ab0t.com/forward-auth/live","register_permissions":"POST https://auth.service.ab0t.com/permissions/registry/register","validate_api_key":"POST https://auth.service.ab0t.com/auth/validate-api-key","validate_token":"POST https://auth.service.ab0t.com/auth/validate-token"}},"status":"healthy","version":"2.0.0-go"}