Auth

login and refresh are public. logout and me only accept JWT access tokens.

POST /api/v1/auth/login

Real responses are wrapped in data and include:

The serialized role values are superAdmin, admin, and user.

Refresh

POST /api/v1/auth/refresh

Returns the same structure as login.

POST /api/v1/auth/logout
Authorization: Bearer <access_token>

Returns 204 No Content.

GET /api/v1/auth/me
Authorization: Bearer <access_token>

GET /api/v1/system/bootstrap

Returns:

This endpoint reports runtime configuration only. It does not confirm whether the bootstrap SuperAdmin exists.