Identity
Sign up, log in and manage passwords. These endpoints need no authentication.
Sign up
Creates a new **organization** (Cloud plan) and its first **user** (role: `owner`) in a single atomic database transaction.
Log in
Authenticates a user and returns a JWT session token valid for **1 hour**.
Request a password reset
Always returns the same generic response whether or not the email is registered, to prevent account enumeration — same convention as `POST /login`.
Reset a password
Consumes a single-use password reset token and sets a new password, returning a JWT session token valid for **1 hour** — the user is signed in immediately.
Verify an email address
Consumes a single-use, 24-hour email verification token sent at signup.
Resend verification email
Always returns the same response whether or not the email is registered, or already verified — same non-enumeration guarantee as /forgot-password.