Authentication API

Use these endpoints to create, inspect, refresh, and revoke user sessions.

Base path: /api/auth

Endpoint overview

Method	Path	Authentication	Purpose
POST	/login	Public	Exchange credentials for an access token
GET	/session	Authorization header	Validate the current session
GET	/me	Bearer token	Read the current user
POST	/logout	Token in JSON body	Revoke the supplied session token
POST	/logout-all	Bearer token	Revoke every session for the current user

Bearer authentication

Send the token returned by login on protected endpoints:

Authorization: Bearer <access_token>

Login

POST /api/auth/login

Authenticate with a username and password.

Authentication: Public

Request body: application/json

Field	Type	Required	Description
username	string	Yes	Sociovite username
password	string	Yes	Account password

{
  "username": "your_username",
  "password": "your_password"
}

Success response — 200 OK:

{
  "token": "eyJhbGciOi...",
  "expires_at": "2026-07-29T23:26:03.041292+07:00",
  "roles": [
    "user"
  ],
  "user": {
    "userId": "user_id",
    "name": "user",
    "email": "user@example.com",
    "username": "user"
  }
}

Use token as the bearer access token. The contract declares expires_at as a string and does not constrain its date format.

Other responses:

Status	Meaning
400	Invalid request body or missing credentials
401	Invalid credentials

curl -X POST \
  "$SOCIOVITE_API_URL/api/auth/login" \
  -H 'accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "username": "your_username",
    "password": "your_password"
  }'

Validate a session

GET /api/auth/session

Validate the supplied access token and return the session identity.

Required header:

Authorization: Bearer <access_token>

Success response — 200 OK:

{
  "valid": true,
  "expires_at": "2026-07-29T23:26:03.041292+07:00",
  "roles": [
    "admin"
  ],
  "user": {
    "userId": "user_id",
    "name": "Admin",
    "email": "admin@example.com",
    "username": "admin"
  }
}

Other response: 401 when the token is invalid or missing.

curl \
  "$SOCIOVITE_API_URL/api/auth/session" \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer <access_token>'

Get the current user

GET /api/auth/me

Return the user represented by the bearer token.

Authentication: Bearer token

Success response — 200 OK:

{
  "userId": "user_id",
  "name": "Admin",
  "email": "admin@example.com",
  "username": "admin"
}

Other response: 401 when the token is unauthorized or invalid.

curl \
  "$SOCIOVITE_API_URL/api/auth/me" \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer <access_token>'

Logout one session

POST /api/auth/logout

Invalidate the session represented by the supplied token. Swagger describes this body value as a refresh token.

Authentication: No bearer header is declared. The token is sent in the body.

Request body: application/json

Field	Type	Required
token	string	Yes

{
  "token": "current_access_token"
}

Success response — 200 OK:

{
  "success": true,
  "message": "Logout successful"
}

Other responses:

Status	Meaning
400	Invalid request
401	Invalid token

curl -X POST \
  "$SOCIOVITE_API_URL/api/auth/logout" \
  -H 'accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "token": "current_access_token"
  }'

Logout all devices

POST /api/auth/logout-all

Invalidate every session associated with the authenticated user.

Authentication: Bearer token

Request body: None

Success response — 200 OK:

{
  "success": true,
  "message": "All sessions revoked",
  "revoked": 3
}

revoked is the number of sessions invalidated.

Other response: 401 when the request is unauthorized.

curl -X POST \
  "$SOCIOVITE_API_URL/api/auth/logout-all" \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer <access_token>'

Error shape

Authentication errors use the shared error model:

{
  "success": false,
  "error": "Invalid credentials",
  "message": "Unable to authenticate the request"
}