auth

El dominio auth tiene 9 acciones. En la superficie meta se alcanzan todas a través de arcane_auth; en la individual, cada una es una herramienta propia; en la dinámica se ejecutan con arcane_execute_action y el ID canónico.

Resumen

Acción	Título	Tipo
auth.avatar_delete	Delete own avatar	destructiva
auth.avatar_upload	Upload own avatar	escritura
auth.change_password	Change password	destructiva
auth.login	Login	escritura
auth.logout	Logout	escritura
auth.logout_other_sessions	Logout all other sessions	destructiva
auth.me	Get current user	lectura
auth.profile_update	Update own profile	escritura
auth.refresh	Refresh token	escritura

Acciones

auth.avatar_delete

Delete own avatar

Remove the current user’s custom profile picture, reverting to the default avatar.

• Tipo: destructiva — exige confirm: true
• Parámetros obligatorios: ninguno
• Meta-herramienta: arcane_auth con "action": "avatar_delete"
• Herramienta individual: arcane_auth_avatar_delete
• Ruta de Arcane: DELETE /api/auth/me/avatar
• ID de operación: delete-my-avatar
• Uso: Removes the caller’s custom profile picture so the default avatar is shown, and succeeds even when none was set. Returns the updated user without avatarUrl. To replace the picture use auth.avatar_upload directly.
• Acciones relacionadas: auth.avatar_upload, user.avatar

auth.avatar_upload

Upload own avatar

Upload a custom profile picture (PNG, JPEG or WebP). Replaces any existing avatar.

• Tipo: escritura
• Parámetros obligatorios: ninguno
• Meta-herramienta: arcane_auth con "action": "avatar_upload"
• Herramienta individual: arcane_auth_avatar_upload
• Ruta de Arcane: POST /api/auth/me/avatar
• ID de operación: upload-my-avatar
• Uso: Sets the caller’s profile picture, replacing any existing one. file is a file object (filename, contentBase64) holding a PNG, JPEG or WebP no larger than the avatarMaxUploadSizeMb setting (default 2 MB). An opaque PNG may be stored re-encoded as JPEG. Returns the updated user. Read the image back with user.avatar using the id from auth.me.
• Acciones relacionadas: auth.avatar_delete, user.avatar, auth.me

auth.change_password

Change password

Change the current user’s password

• Tipo: destructiva — exige confirm: true
• Parámetros obligatorios: newPassword
• Meta-herramienta: arcane_auth con "action": "change_password"
• Herramienta individual: arcane_auth_change_password
• Ruta de Arcane: POST /api/auth/password
• ID de operación: change-password
• Uso: Changes the caller’s own password: currentPassword is required in practice, newPassword must satisfy the authPasswordPolicy setting (settings.get). A wrong currentPassword fails with 401. Clears requiresPasswordChange and revokes every other session of the account (with an API key, all of them). If this is the account in ARCANE_PASSWORD, update that setting or this server can no longer log in. To set another user’s password use user.update.
• Acciones relacionadas: user.update, settings.get, auth.logout_other_sessions

auth.login

Login

Authenticate a user with username and password

• Tipo: escritura
• Parámetros obligatorios: password, username
• Meta-herramienta: arcane_auth con "action": "login"
• Herramienta individual: arcane_auth_login
• Ruta de Arcane: POST /api/auth/login
• ID de operación: login
• Uso: Checks a username (or account email) and password (fails when local authentication is disabled) and returns status authenticated with token, refreshToken, expiresAt and user, or status mfa_required with mfa.transactionId: pass it to passkey.mfa_begin then passkey.mfa_finish, or to passkey.recovery_code_use. An authenticated login opens a new session but only returns its tokens. This server keeps using its own configured credentials. Rate limited to 5 calls per minute per client IP, a budget this server’s own session logins also use.
• Acciones relacionadas: auth.refresh, passkey.mfa_begin, passkey.recovery_code_use, passkey.login_begin

auth.logout

Logout

Clear authentication session

• Tipo: escritura
• Parámetros obligatorios: ninguno
• Meta-herramienta: arcane_auth con "action": "logout"
• Herramienta individual: arcane_auth_logout
• Ruta de Arcane: POST /api/auth/logout
• ID de operación: logout
• Uso: Ends the session this server opened with ARCANE_USERNAME and ARCANE_PASSWORD (also when an API key is configured as well). The next call that needs a session logs in again. With only an API key there is no session: the call succeeds but ends nothing, unless refreshToken (from auth.login or auth.refresh) is given, which revokes that token’s session in any case (the refresh and __Secure-refresh cookie parameters are the browser’s way to send it). Returns a message. To revoke the account’s other sessions use auth.logout_other_sessions.
• Acciones relacionadas: auth.logout_other_sessions, auth.login

auth.logout_other_sessions

Logout all other sessions

Revoke every session for the current user except the one making this request

• Tipo: destructiva — exige confirm: true
• Parámetros obligatorios: ninguno
• Meta-herramienta: arcane_auth con "action": "logout_other_sessions"
• Herramienta individual: arcane_auth_logout_other_sessions
• Ruta de Arcane: POST /api/auth/sessions/logout-all
• ID de operación: logout-all-other-sessions
• Uso: Signs the caller’s account out everywhere else: every other session is revoked and its refresh token stops working. Called with an API key there is no current session, so every session of the key’s owner is revoked. API keys themselves keep working (revoke those with api_key.my_delete).
• Acciones relacionadas: auth.logout, auth.change_password, api_key.my_list

auth.me

Get current user

Get the currently authenticated user’s information

• Tipo: lectura
• Parámetros obligatorios: ninguno
• Meta-herramienta: arcane_auth con "action": "me"
• Herramienta individual: arcane_auth_me
• Ruta de Arcane: GET /api/auth/me
• ID de operación: get-current-user
• Uso: The user behind this server’s credential (for a personal API key, the key’s owner): id, username, displayName, email, roleAssignments, permissionsByEnv (‘global’ covers every environment), requiresPasswordChange and avatarUrl. Needs no permission. Use it to learn your own userId or check what you may do. To read another user use user.get.
• Acciones relacionadas: auth.profile_update, auth.change_password, user.get, api_key.my_list

auth.profile_update

Update own profile

Update the current user’s display name and email. Forbidden for OIDC-managed accounts.

• Tipo: escritura
• Parámetros obligatorios: ninguno
• Meta-herramienta: arcane_auth con "action": "profile_update"
• Herramienta individual: arcane_auth_profile_update
• Ruta de Arcane: PUT /api/auth/me/profile
• ID de operación: update-my-profile
• Uso: Edits the caller’s own profile. Only the fields sent change: displayName, email, locale, timeFormat (auto, 12h, 24h), fontSize (12-20) and preferences (merged field by field, e.g. themeMode, applicationTheme, accentColor, defaultLandingPage, while environmentColors replaces its whole map). OIDC accounts get 403 for displayName or email. Returns the updated user. To edit another user (or a username) use user.update.
• Acciones relacionadas: auth.me, user.update

auth.refresh

Refresh token

Obtain a new access token using a refresh token

• Tipo: escritura
• Parámetros obligatorios: ninguno
• Meta-herramienta: arcane_auth con "action": "refresh"
• Herramienta individual: arcane_auth_refresh
• Ruta de Arcane: POST /api/auth/refresh
• ID de operación: refresh-token
• Uso: Exchanges a refreshToken from auth.login (or an earlier auth.refresh) for a new token and refreshToken. The refresh token rotates, so the one passed in stops working, and it fails with 401 once its session was revoked (auth.logout, auth.logout_other_sessions, auth.change_password) or when no refreshToken is given. The refresh and __Secure-refresh cookie parameters are how browsers send the same token, so pass refreshToken instead. Rate limited to 30 calls per minute per client IP.
• Acciones relacionadas: auth.login