认证接口负责浏览器会话和当前用户信息。login 与 refresh 是公开接口,logout 和 me 只接受 JWT。
Login
Request body
Response
{
"data": {
"accessToken": "eyJhbGciOiJIUzI1NiIs...",
"refreshToken": "refresh-token-value",
"accessTokenExpiresAtUtc": "2026-04-08T12:15:00Z",
"refreshTokenExpiresAtUtc": "2026-05-08T12:00:00Z",
"user": {
"id": "01956f8d-0000-0000-0000-000000000001",
"username": "admin",
"role": "superAdmin",
"isActive": true,
"createdAtUtc": "2026-04-08T12:00:00Z",
"updatedAtUtc": "2026-04-08T12:00:00Z",
"lastLoginAtUtc": "2026-04-08T12:00:00Z",
"permissions": []
}
}
}
Refresh
POST /api/v1/auth/refresh
Request body
Response
返回与 Login 相同的 data 结构,但 token 会轮换。
Logout
Authorization: Bearer <access_token>
Request body
Response
成功时返回 204 No Content。
Current user
Authorization: Bearer <access_token>
Response
返回当前登录用户的 data 对象,字段与 login.data.user 一致。
System bootstrap
GET /api/v1/system/bootstrap
这是公开接口,用于返回当前运行实例的一些基础配置摘要。
Response
{
"data": {
"apiKeyRequired": true,
"maxUploadSizeBytes": 10485760,
"allowedContentTypes": [
"image/jpeg",
"image/png",
"image/webp",
"image/gif"
]
}
}
字段说明
这个端点不会告诉你 SuperAdmin 是否已经创建。它只是运行时配置摘要。