Sign up, exchange credentials for an access token, and issue API keys for server-to-server calls.
Interactive clients send the JWT returned by a session call; integrations send a long-lived API key. Both travel in the Authorization header.
https://api.reportauto.euEvery authenticated call carries an Authorization header. Interactive clients send the JWT access token returned by a session call; server-to-server integrations send a long-lived API key as `API_KEY <key>`. Tokens are scoped to the rights granted to the account that issued them.
Registers a user and returns an access token, so a freshly created account can call the API immediately. Set send_verification_code to have the API email a code the account is later verified with.
Authentication None
Login handle. An email address is accepted here too.
Email address the account is reachable at.
Kind of account being created.
Display name of the person behind the account.
Optional. Omit it to create a passwordless account that signs in with emailed codes.
Whether to email a verification code on signup.
ISO country, e.g. USA.
Preferred language code, e.g. en.
1curl -X POST "https://api.reportauto.eu/api/session/signup" \
2 -H "Content-Type: application/json" \
3 -H "x-api-version: 2" \
4 -d '{
5 "username": "jamie",
6 "type": "Seller",
7 "email": "jamie@example.com",
8 "fullname": "Jamie Rivera",
9 "send_verification_code": false,
10 "country": "USA",
11 "language": "en"
12 }'{
"id": 2616,
"name": "Jamie Rivera",
"type": "Seller",
"token": "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9...",
"username": "jamie",
"role": "User",
"agreement": {
"signed": 0,
"timestamp": null
}
}{
"id": integer,
"name": string,
"email": string,
"phone": string,
"type": enum,
}Registers a device rather than a person, so a mobile app can start capturing before the user signs up. Same endpoint as above, distinguished by sending device fields instead of a username.
Authentication None
Platform, e.g. IOS or ANDROID.
Stable per-install device identifier.
Hardware model, e.g. "12 mini".
1curl -X POST "https://api.reportauto.eu/api/session/signup" \
2 -H "Content-Type: application/json" \
3 -d '{
4 "device": "IOS",
5 "device_id": "some_device_id",
6 "device_model": "12 mini"
7 }'Exchanges credentials for an access token. Three credential shapes are accepted: username and password, username and an emailed verification code, or a request ID paired with the session key from a capture link.
Authentication None
Used with either password or verification_code.
Account password.
Code emailed by the authorization-code request below. Use instead of a password.
Listing request the session belongs to, for capture-link sign-in.
Short key issued with a capture link, paired with request_id.
1curl -X POST "https://api.reportauto.eu/api/session" \
2 -H "Content-Type: application/json" \
3 -d '{
4 "username": "jamie@example.com",
5 "password": "Some_user_passphrase"
6 }'Emails a one-time verification code to the address behind the username. Feed the code back into the session call to sign in without a password.
Authentication None
Username or email address to send the code to.
1curl -X POST "https://api.reportauto.eu/api/session/request" \
2 -H "Content-Type: application/json" \
3 -d '{ "username": "jamie@example.com" }'Returns the account behind the credential, including profile, theme, verification state and notification preferences. Use it to validate a token and to read back settings after an update.
Authentication Access token or API key
1curl "https://api.reportauto.eu/api/session" \
2 -H "Authorization: API_KEY $CAROOM_API_KEY"{
"user": {
"id": 2616,
"name": "Jamie Rivera",
"type": "Seller",
"project": 1,
"username": "jamie",
"role": "User",
"email": "jamie@example.com",
"phone": null,
"avatar": "https://d30s8rpq2bfonk.cloudfront.net/avatars/2616.png",
"agreement": { "signed": 0, "timestamp": null },
"public_name": null,
"theme": "light",
"visibility": null,
"device_model": null,
"verified": "VERIFIED"
}
}{
"user": {
"id": string,
"name": string,
"email": string
}
}Confirms an email address with the code sent at signup, moving the account out of the unverified state.
Authentication None
Address being verified.
Verification code from the email.
1curl -X PATCH "https://api.reportauto.eu/api/users/verify" \
2 -H "Content-Type: application/json" \
3 -H "x-api-version: 2" \
4 -d '{
5 "email": "jamie@example.com",
6 "code": "301705"
7 }'Sends a fresh verification code to an unverified account.
Authentication None
Account to resend the code to.
1curl -X POST "https://api.reportauto.eu/api/session/verify/resend" \
2 -H "Content-Type: application/json" \
3 -d '{ "username": "jamie@example.com" }'Emails a reset token to the address on the account.
Authentication None
Address to send the reset token to.
1curl -X POST "https://api.reportauto.eu/api/session/forgot" \
2 -H "Content-Type: application/json" \
3 -H "x-api-version: 2" \
4 -d '{ "email": "jamie@example.com" }'Sets a new password using the token from the reset email.
Authentication None
Token from the reset email.
The new password.
1curl -X POST "https://api.reportauto.eu/api/session/reset" \
2 -H "Content-Type: application/json" \
3 -H "x-api-version: 2" \
4 -d '{
5 "reset_token": "729098",
6 "password": "A_new_phrase_pass"
7 }'Issues a long-lived key for server-to-server use. Send it on later requests as `Authorization: API_KEY <key>`. Name each key after the integration that holds it so it can be revoked on its own.
Authentication Access token
Label for the key, e.g. "Claims Key".
1curl -X POST "https://api.reportauto.eu/api/api_keys" \
2 -H "Authorization: $CAROOM_ACCESS_TOKEN" \
3 -H "Content-Type: application/json" \
4 -d '{ "name": "Claims Key" }'