---
title: API: auth
description: REST-эндпоинты с тегом auth — сгенерировано из OpenAPI-контракта платформы (6 операций).
locale: ru
version: 0.2.0
canonical: https://enterium-developer-docs.pages.dev/developers/ru/api/auth/
---

> Documentation index: https://enterium-developer-docs.pages.dev/developers/llms.txt — every page of this portal has a Markdown twin at <route>.md; the frozen API contract is at https://enterium-developer-docs.pages.dev/developers/api/openapi.json.

:::note
Сгенерировано из OpenAPI-контракта — не редактировать руками. Сводки операций и описания полей приводятся на английском (дословно из контракта). Интерактивный обозреватель с полными схемами: [https://entherium.duckdns.org:8443/reference](https://entherium.duckdns.org:8443/reference); замороженная спецификация этой сборки: [openapi.json](/developers/api/openapi.json).
:::

## `POST /api/v1/auth/agent-token`

Mint Agent Token

[Открыть отдельной страницей →](./post-auth-agent-token/)

mint (or rotate) a scoped AGENT token + its contract grants.

Superuser-only. Creates (or reuses) the agent identity and REPLACES its grant pool
with `body.grants` (default-deny — a contract not listed is inaccessible). Changing
the pool or capabilities later is a grant edit, no re-mint needed. `publish` is granted only when listed
explicitly: withhold on prod contracts by default).

**Авторизация:** нужен `Authorization: Bearer <token>`

| Параметр | Где | Обязателен | Тип | Описание |
| --- | --- | --- | --- | --- |
| `Idempotency-Key` | header | нет | `string` | Optional. |

**Тело запроса:** `application/json` — схема `AgentTokenRequest`

| Поле | Тип | Обязательно | Описание |
| --- | --- | --- | --- |
| `email` | `string` | нет |  |
| `expires_days` | `integer` | нет |  |
| `full_name` | `string \| null` | нет |  |
| `grants` | `массив AgentGrantSpec` | да |  |
| `revoke_prior` | `boolean` | нет |  |

_Пример:_

```json
{
  "email": "agent@entherium.dev",
  "expires_days": 90,
  "full_name": "Partner agent",
  "grants": [
    {
      "capabilities": [
        "submit",
        "launch",
        "cancel",
        "edit_config"
      ],
      "salescontract": 40
    }
  ],
  "revoke_prior": true
}
```

**Ответы:**

| Код | Смысл | Тело |
| --- | --- | --- |
| `200` | Successful Response | `ServiceTokenResponse` |
| `401` | Missing or invalid authentication credentials | `ErrorResponse` |
| `409` | The e-mail belongs to a non-agent user; refusing to convert | `ErrorResponse` |
| `422` | Validation Error | `HTTPValidationError` |

_Пример ответа (200):_

```json
{
  "access_token": "eyJhbGciOiJIUzI1NiJ9.<payload>.<signature>",
  "api_scope": "agent",
  "email": "agent@entherium.dev",
  "expires_in": 7776000,
  "token_type": "bearer",
  "user_guid": 5
}
```

## `POST /api/v1/auth/login`

Login

[Открыть отдельной страницей →](./post-auth-login/)

OAuth2 password flow. `username` field is the user's email.

**Авторизация:** токен не нужен

| Параметр | Где | Обязателен | Тип | Описание |
| --- | --- | --- | --- | --- |
| `Idempotency-Key` | header | нет | `string` | Optional. |

**Тело запроса:** `application/x-www-form-urlencoded` — схема `Body_login_api_v1_auth_login_post`

| Поле | Тип | Обязательно | Описание |
| --- | --- | --- | --- |
| `client_id` | `string \| null` | нет |  |
| `client_secret` | `string \| null` | нет |  |
| `grant_type` | `string \| null` | нет |  |
| `password` | `string` | да |  |
| `scope` | `string` | нет |  |
| `username` | `string` | да |  |

**Ответы:**

| Код | Смысл | Тело |
| --- | --- | --- |
| `200` | Successful Response | `TokenPair` |
| `422` | Validation Error | `HTTPValidationError` |

## `GET /api/v1/auth/me`

Me

[Открыть отдельной страницей →](./get-auth-me/)

**Авторизация:** нужен `Authorization: Bearer <token>`

**Ответы:**

| Код | Смысл | Тело |
| --- | --- | --- |
| `200` | Successful Response | `MeResponse` |
| `401` | Missing or invalid authentication credentials | `ErrorResponse` |

_Пример ответа (200):_

```json
{
  "email": "agent@entherium.dev",
  "full_name": "Partner agent",
  "guid": 5,
  "is_active": true,
  "is_superuser": false,
  "is_team": false,
  "last_login": "2026-09-03T08:12:41Z"
}
```

## `POST /api/v1/auth/refresh`

Refresh

[Открыть отдельной страницей →](./post-auth-refresh/)

Exchange a refresh token for a new access token.

**Авторизация:** токен не нужен

| Параметр | Где | Обязателен | Тип | Описание |
| --- | --- | --- | --- | --- |
| `Idempotency-Key` | header | нет | `string` | Optional. |

**Тело запроса:** `application/json` — схема `RefreshRequest`

| Поле | Тип | Обязательно | Описание |
| --- | --- | --- | --- |
| `refresh_token` | `string` | да |  |

_Пример:_

```json
{
  "refresh_token": "<refresh token from /api/v1/auth/login>"
}
```

**Ответы:**

| Код | Смысл | Тело |
| --- | --- | --- |
| `200` | Successful Response | `AccessOnly` |
| `422` | Validation Error | `HTTPValidationError` |

## `POST /api/v1/auth/service-token`

Mint Service Token

[Открыть отдельной страницей →](./post-auth-service-token/)

Mint (or rotate) a long-lived READ-ONLY access token for an external agent.

Superuser-only. The endpoint can only create/serve users with
read-only agent scope — it is structurally unable to hand out
full-access tokens. Re-minting reactivates a previously revoked user.

**Авторизация:** нужен `Authorization: Bearer <token>`

| Параметр | Где | Обязателен | Тип | Описание |
| --- | --- | --- | --- | --- |
| `Idempotency-Key` | header | нет | `string` | Optional. |

**Тело запроса:** `application/json` — схема `ServiceTokenRequest`

| Поле | Тип | Обязательно | Описание |
| --- | --- | --- | --- |
| `email` | `string` | нет |  |
| `expires_days` | `integer` | нет |  |
| `full_name` | `string \| null` | нет |  |
| `revoke_prior` | `boolean` | нет |  |

**Ответы:**

| Код | Смысл | Тело |
| --- | --- | --- |
| `200` | Successful Response | `ServiceTokenResponse` |
| `401` | Missing or invalid authentication credentials | `ErrorResponse` |
| `409` | The e-mail belongs to an existing non-read-only user; refusing to convert | `ErrorResponse` |
| `422` | Validation Error | `HTTPValidationError` |

_Пример ответа (200):_

```json
{
  "access_token": "eyJhbGciOiJIUzI1NiJ9.<payload>.<signature>",
  "api_scope": "agent",
  "email": "agent@entherium.dev",
  "expires_in": 7776000,
  "token_type": "bearer",
  "user_guid": 5
}
```

## `DELETE /api/v1/auth/service-token/{guid}`

Revoke Service Token

[Открыть отдельной страницей →](./delete-auth-service-token-guid/)

Revoke a read-only service user: deactivate + kill all minted tokens.

Effective immediately — auth re-reads the user row on every request.
Only read-only agent identities are addressable here (404 otherwise),
so a typo'd guid can never lock out a human/admin account.

**Авторизация:** нужен `Authorization: Bearer <token>`

| Параметр | Где | Обязателен | Тип | Описание |
| --- | --- | --- | --- | --- |
| `guid` | path | да | `integer` |  |
| `Idempotency-Key` | header | нет | `string` | Optional. |

**Ответы:**

| Код | Смысл | Тело |
| --- | --- | --- |
| `204` | Successful Response | — |
| `401` | Missing or invalid authentication credentials | `ErrorResponse` |
| `422` | Validation Error | `HTTPValidationError` |