Sintj API (1.34.0)

Returns the account id and email for the caller identified by the _sintj_session cookie.

Redirects the browser to Stytch's hosted OAuth start URL for the given tenant (identified by slug) and provider. Not JSON — a 302 browser redirect.

Reached twice in sequence for a single login: first at the fixed Stytch-registered redirect URI (shared across every tenant and region, since OAuth providers don't allow per-tenant redirect URIs), where the Cloudflare Worker rewrites the request into a 302 to this same path on the tenant's own host (subdomain or custom domain) — that hop is Worker-side and not a Rails request. Carries only token — Stytch validates redirect URLs by exact match including query string, so no other params can ride on it. The tenant is resolved from the organization_id in Stytch's authenticated response, and return_to (captured at /{provider}/start) travels in a short-lived cookie, not a query param. On the tenant's own host, Rails verifies the OAuth token via Stytch, finds-or-creates the local account, sets the real session cookie, and redirects to return_to. Not JSON — a 302 browser redirect.

Verifies the password against Stytch (not a locally-stored hash) for the given tenant's Organization. On success, sets the _sintj_session cookie and returns 204.

Clears the _sintj_session cookie. Idempotent — returns 204 whether or not a session cookie was present.

Returns 200 when the service is running. No authentication required.

Returns a tenant's full record including per-step onboarding status. Requires an internal service key — not exposed to end users.

Soft-deletes a tenant by setting deleted_at. Only disabled tenants may be deleted; attempting to delete an active tenant returns 422. Requires an internal service key — not exposed to end users.

Creates a tenant record and seeds pending onboarding status rows. Requires an internal service key — not exposed to end users.

Sets a tenant's status to active. Idempotent — enabling an already-active tenant is a no-op and still returns 200. Requires an internal service key.

Sets a tenant's status to disabled. Idempotent — disabling an already-disabled tenant is a no-op and still returns 200. Requires an internal service key.

Returns the same {tenant_id, slug, host, region, allowed_auth_methods} record normally pushed to Cloudflare KV (Platform::SyncTenantKvService), so a local frontend/Worker (e.g. wrangler dev without --remote) can resolve tenant routing without real remote KV credentials. Public and unauthenticated, but development-environment only — returns 404 in every other environment. Never available in production.

Returns a paginated, filterable, full-text-searchable list of tenants. Filter payload is in the request body to avoid URL length limits. Requires an internal service key — not exposed to end users.

Returns zone codes read from the ZONES environment variable. Config-driven — no pagination or filtering. Requires an internal service key.

Creates a new workspace under an existing tenant. Requires a valid X-Schema-Name header identifying the tenant schema.

Assigns an existing user to a workspace with a given role. Duplicate assignments are rejected with a 422 validation error. Requires a valid X-Schema-Name header.

Returns a paginated, filterable, full-text-searchable list of workspaces within a tenant schema. Filter payload is in the request body. Requires a valid session cookie and X-Schema-Name header identifying the tenant schema.

Initiates the invitation flow for a new tenant user: creates a Stytch member, seeds a Tenant::User record with status "invited", and sends an invitation email. Not yet implemented — returns 501 until SIN-1329 is complete. Full contract (200 success + 422 validation error) added when SIN-1329 ships. Requires a valid X-Schema-Name header identifying the tenant schema.

Sets a tenant user's status to "active". Idempotent — enabling an already-active user succeeds. Requires a valid X-Schema-Name header identifying the tenant schema.

Sets a tenant user's status to "disabled", preventing login. Idempotent. Requires a valid X-Schema-Name header identifying the tenant schema.

Returns a paginated, filterable, full-text-searchable list of users within a tenant schema. Filter payload is in the request body. auth_linkage_id and tenant_id are never included in the response. Requires a valid session cookie and X-Schema-Name header identifying the tenant schema.

Creates a Platform::User record (status: invited) and a mirrored Tenant::User in the tenant's Apartment schema, then sends an invitation email with an accept link. Guards: schema_provisioning step must be completed; no Platform::User may exist yet for this tenant. Requires an internal service key.

Validates the invitation token, sets the owner's password and name, flips both the Platform::User and Tenant::User to status active, and records invitation_accepted_at. No authentication header required — the token in the URL is the auth factor.

Partial update of the tenant's authentication policy settings. Only keys present in the request body are written; omitted keys are left unchanged. Unknown keys are silently ignored. The legacy mfa_required key is never written by this endpoint. Requires a valid X-Schema-Name header identifying the tenant schema.

Internal endpoint called by the central provisioning service to create an Apartment PostgreSQL schema for a tenant in this zone's database and seed OrgSettings defaults. Idempotent — returns 200 if the schema already exists. Authenticated via X-Service-JWT — never exposed to end users.

Pure stateless suggestion — returns ranked acronym candidates for the given name and object type. No database reads or writes. The caller presents these to the user, who picks one (or types their own) before saving the entity. Once saved, the code is immutable (enforced by Acronymize::Suggestable on the model). Authenticated via X-Service-JWT only — no X-Schema-Name needed (no DB access).