MANSOQ Frontend module · STATIC DECLARATIONS
Auth Api client API reference · mansoq-hmis-web
12 client route/call declarations with path parameters, named payload/response types and source references. Exact server acceptance and permissions require the matched backend contract.
Static API contract — behavior review pending. Source baseline f6e9f05f76d4.
Enable JavaScript to inspect structured operation, parameter, schema and permission evidence. Download this reference and its evidence.
Client contract scope
These 12 declarations come from repositories/teleicu/mansoq-hmis-web/src/types/auth/authApi.ts. Client types and noAuth flags describe the caller; they do not authorize a server action. Dynamic paths and missing backend matches are retained as review work, not repaired into invented endpoints.
Operation map
| Client method | HTTP method | Path pattern | Resolution |
|---|---|---|---|
| default.login | POST | /api/v1/auth/login/ |
literal |
| default.logout | POST | /api/v1/auth/logout/ |
literal |
| default.tokenRefresh | POST | /api/v1/auth/token/refresh/ |
literal |
| default.updatePassword | PUT | /api/v1/password_change/ |
literal |
| default.forgotPassword | POST | /api/v1/password_reset/ |
literal |
| default.checkResetToken | POST | /api/v1/password_reset/check/ |
literal |
| default.resetPassword | POST | /api/v1/password_reset/confirm/ |
literal |
| default.totp.setup | POST | /api/v1/mfa/totp/setup/ |
literal |
| default.totp.verify | POST | /api/v1/mfa/totp/verify/ |
literal |
| default.totp.regenerateBackupCodes | POST | /api/v1/mfa/totp/regenerate_backup_codes/ |
literal |
| default.totp.disable | POST | /api/v1/mfa/totp/disable/ |
literal |
| default.mfa.login | POST | /api/v1/mfa/login/ |
literal |
default.login
Auth related APIs
POST /api/v1/auth/login/. typed route object; literal. multiple static method/path matches across source registrations; installed target and boundary require review.
request type: LoginRequest. client-side declaration; not proof of accepted server payload.
LoginRequest declared fields:
| Field | Type | Required | Description |
|---|---|---|---|
| username | string | true | — |
| password | string | true | — |
response type: LoginResponse. client-side declaration; not proof of accepted server payload.
Composed/inherited schema references: JwtTokenObtainPair, MfaAuthenticationToken. Exact generic composition is retained in the structured reference and requires server-side confirmation.
Operational limitation: request validation, permission checks, error statuses and irreversible side effects belong to the server implementation. An unmatched or computed client route requires contract review before use.
default.logout
POST /api/v1/auth/logout/. typed route object; literal. multiple static method/path matches across source registrations; installed target and boundary require review.
request type: JwtTokenObtainPair. client-side declaration; not proof of accepted server payload.
JwtTokenObtainPair declared fields:
| Field | Type | Required | Description |
|---|---|---|---|
| access | string | true | — |
| refresh | string | true | — |
response type: void. client-side declaration; not proof of accepted server payload.
Operational limitation: request validation, permission checks, error statuses and irreversible side effects belong to the server implementation. An unmatched or computed client route requires contract review before use.
default.tokenRefresh
POST /api/v1/auth/token/refresh/. typed route object; literal. multiple static method/path matches across source registrations; installed target and boundary require review.
request type: TokenRefreshRequest. client-side declaration; not proof of accepted server payload.
TokenRefreshRequest declared fields:
| Field | Type | Required | Description |
|---|---|---|---|
| refresh | JwtTokenObtainPair["refresh"] | true | — |
response type: JwtTokenObtainPair. client-side declaration; not proof of accepted server payload.
Operational limitation: request validation, permission checks, error statuses and irreversible side effects belong to the server implementation. An unmatched or computed client route requires contract review before use.
default.updatePassword
PUT /api/v1/password_change/. typed route object; literal. no exact statically resolved backend match in scanned contracts.
request type: UpdatePasswordRequest. client-side declaration; not proof of accepted server payload.
UpdatePasswordRequest declared fields:
| Field | Type | Required | Description |
|---|---|---|---|
| old_password | string | true | — |
| username | string | true | — |
| new_password | string | true | — |
response type: PasswordResetResponse. client-side declaration; not proof of accepted server payload.
PasswordResetResponse declared fields:
| Field | Type | Required | Description |
|---|---|---|---|
| detail | string | false | — |
| status | RequestStatus | false | — |
Operational limitation: request validation, permission checks, error statuses and irreversible side effects belong to the server implementation. An unmatched or computed client route requires contract review before use.
default.forgotPassword
POST /api/v1/password_reset/. typed route object; literal. multiple static method/path matches across source registrations; installed target and boundary require review.
request type: ForgotPasswordRequest. client-side declaration; not proof of accepted server payload.
ForgotPasswordRequest declared fields:
| Field | Type | Required | Description |
|---|---|---|---|
| username | string | true | — |
response type: PasswordResetResponse. client-side declaration; not proof of accepted server payload.
Operational limitation: request validation, permission checks, error statuses and irreversible side effects belong to the server implementation. An unmatched or computed client route requires contract review before use.
default.checkResetToken
POST /api/v1/password_reset/check/. typed route object; literal. multiple static method/path matches across source registrations; installed target and boundary require review.
request type: CheckResetTokenRequest. client-side declaration; not proof of accepted server payload.
CheckResetTokenRequest declared fields:
| Field | Type | Required | Description |
|---|---|---|---|
| token | string | true | — |
response type: PasswordResetResponse. client-side declaration; not proof of accepted server payload.
Operational limitation: request validation, permission checks, error statuses and irreversible side effects belong to the server implementation. An unmatched or computed client route requires contract review before use.
default.resetPassword
POST /api/v1/password_reset/confirm/. typed route object; literal. multiple static method/path matches across source registrations; installed target and boundary require review.
request type: ResetPasswordRequest. client-side declaration; not proof of accepted server payload.
ResetPasswordRequest declared fields:
| Field | Type | Required | Description |
|---|---|---|---|
| token | string | true | — |
| password | string | true | — |
response type: PasswordResetResponse. client-side declaration; not proof of accepted server payload.
Operational limitation: request validation, permission checks, error statuses and irreversible side effects belong to the server implementation. An unmatched or computed client route requires contract review before use.
default.totp.setup
POST /api/v1/mfa/totp/setup/. typed route object; literal. multiple static method/path matches across source registrations; installed target and boundary require review.
request type: PasswordRequest. client-side declaration; not proof of accepted server payload.
PasswordRequest declared fields:
| Field | Type | Required | Description |
|---|---|---|---|
| password | string | true | — |
response type: TotpSetupResponse. client-side declaration; not proof of accepted server payload.
TotpSetupResponse declared fields:
| Field | Type | Required | Description |
|---|---|---|---|
| uri | string | true | — |
| secret_key | string | true | — |
Operational limitation: request validation, permission checks, error statuses and irreversible side effects belong to the server implementation. An unmatched or computed client route requires contract review before use.
default.totp.verify
POST /api/v1/mfa/totp/verify/. typed route object; literal. multiple static method/path matches across source registrations; installed target and boundary require review.
request type: TotpVerifyRequest. client-side declaration; not proof of accepted server payload.
TotpVerifyRequest declared fields:
| Field | Type | Required | Description |
|---|---|---|---|
| code | string | true | — |
response type: BackupCodesResponse. client-side declaration; not proof of accepted server payload.
BackupCodesResponse declared fields:
| Field | Type | Required | Description |
|---|---|---|---|
| backup_codes | string[] | true | — |
Operational limitation: request validation, permission checks, error statuses and irreversible side effects belong to the server implementation. An unmatched or computed client route requires contract review before use.
default.totp.regenerateBackupCodes
POST /api/v1/mfa/totp/regenerate_backup_codes/. typed route object; literal. multiple static method/path matches across source registrations; installed target and boundary require review.
request type: PasswordRequest. client-side declaration; not proof of accepted server payload.
response type: BackupCodesResponse. client-side declaration; not proof of accepted server payload.
Operational limitation: request validation, permission checks, error statuses and irreversible side effects belong to the server implementation. An unmatched or computed client route requires contract review before use.
default.totp.disable
POST /api/v1/mfa/totp/disable/. typed route object; literal. multiple static method/path matches across source registrations; installed target and boundary require review.
request type: PasswordRequest. client-side declaration; not proof of accepted server payload.
response type: void. client-side declaration; not proof of accepted server payload.
Operational limitation: request validation, permission checks, error statuses and irreversible side effects belong to the server implementation. An unmatched or computed client route requires contract review before use.
default.mfa.login
POST /api/v1/mfa/login/. typed route object; literal. multiple static method/path matches across source registrations; installed target and boundary require review.
request type: MfaLoginRequest. client-side declaration; not proof of accepted server payload.
MfaLoginRequest declared fields:
| Field | Type | Required | Description |
|---|---|---|---|
| method | MfaMethod | true | — |
| code | string | true | — |
| temp_token | string | true | — |
response type: JwtTokenObtainPair. client-side declaration; not proof of accepted server payload.
Operational limitation: request validation, permission checks, error statuses and irreversible side effects belong to the server implementation. An unmatched or computed client route requires contract review before use.
Pinned source evidence
Links require access to the private source repository.
- repositories/teleicu/mansoq-hmis-web/src/types/auth/authApi.ts:23
- repositories/teleicu/mansoq-hmis-web/src/types/auth/authApi.ts:30
- repositories/teleicu/mansoq-hmis-web/src/types/auth/authApi.ts:36
- repositories/teleicu/mansoq-hmis-web/src/types/auth/authApi.ts:43
- repositories/teleicu/mansoq-hmis-web/src/types/auth/authApi.ts:50
- repositories/teleicu/mansoq-hmis-web/src/types/auth/authApi.ts:58
- repositories/teleicu/mansoq-hmis-web/src/types/auth/authApi.ts:66
- repositories/teleicu/mansoq-hmis-web/src/types/auth/authApi.ts:78
- repositories/teleicu/mansoq-hmis-web/src/types/auth/authApi.ts:84
- repositories/teleicu/mansoq-hmis-web/src/types/auth/authApi.ts:90
- repositories/teleicu/mansoq-hmis-web/src/types/auth/authApi.ts:96
- repositories/teleicu/mansoq-hmis-web/src/types/auth/authApi.ts:108
- repositories/teleicu/mansoq-hmis-web/src/types/auth/auth.ts:12
- repositories/teleicu/mansoq-hmis-web/src/types/auth/auth.ts:21
- repositories/teleicu/mansoq-hmis-web/src/types/auth/auth.ts:7
- repositories/teleicu/mansoq-hmis-web/src/types/auth/auth.ts:17
- repositories/teleicu/mansoq-hmis-web/src/types/auth/auth.ts:41
- repositories/teleicu/mansoq-hmis-web/src/types/auth/auth.ts:31
- repositories/teleicu/mansoq-hmis-web/src/types/auth/auth.ts:23
- repositories/teleicu/mansoq-hmis-web/src/types/auth/auth.ts:27
- repositories/teleicu/mansoq-hmis-web/src/types/auth/auth.ts:36
- repositories/teleicu/mansoq-hmis-web/src/types/auth/auth.ts:56
- repositories/teleicu/mansoq-hmis-web/src/types/auth/auth.ts:60
- repositories/teleicu/mansoq-hmis-web/src/types/auth/auth.ts:65
- repositories/teleicu/mansoq-hmis-web/src/types/auth/auth.ts:69
- repositories/teleicu/mansoq-hmis-web/src/types/auth/auth.ts:73