Passtru

Passtru API

Passtru API as documented publicly: 21 operations. Contract generated from the documentation by API Evangelist (2026-11-10); not the provider's own document.

Documentation GitHub OpenAPI

Operations 21

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/passtru:passtru-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.1.0
info:
  title: Passtru API
  version: '2026-11-10'
  description: 'GENERATED FROM DOCUMENTATION by API Evangelist on 2026-11-10: 21 operation(s) read from 6 public documentation page(s) (each operation
    names its page in x-source). This is not the provider''s published contract; Passtru has published no machine-readable contract that the pipeline
    could find. Engine: local.'
  x-evidence-tiers:
    code-example: 6
    documentation: 15
    pages-with-code: 4
    pages-read: 6
  x-generated-from: documentation
  x-provenance: generated
  x-authored-by: API Evangelist
  x-generated: '2026-11-10'
  x-generator: generate-contract-from-docs.py
  x-engine: local
  x-sources:
  - https://passtru.io/en/developers/public-api
  - https://passtru.io/en/developers/api-endpoints
  - https://passtru.io/en/developers/webhooks
  - https://passtru.io/en/developers/quickstart
  - https://passtru.io/en/developers/express
  - https://passtru.io/en/developers/authentication
servers:
- url: https://login.passtru.io
paths:
  /.well-known/openid-configuration:
    get:
      operationId: get_well_known_openid_configuration
      tags:
      - API
      summary: GET /.well-known/openid-configuration
      x-source: https://passtru.io/en/developers/api-endpoints
      responses:
        '200':
          description: Success (shape read from the example response on the page)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetWellKnownOpenidConfigurationResponse'
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl https://login.passtru.io/.well-known/openid-configuration\nExample response\n{\n \"issuer\": \"https://login.passtru.io\"\
          ,\n \"authorization_endpoint\": \"https://login.passtru.io/oauth/v2/authorize\",\n \"token_endpoint\": \"https://login.passtru.io/oauth/v2/token\"\
          ,\n \"userinfo_endpoint\": \"https://login.passtru.io/oidc/v1/userinfo\",\n \"jwks_uri\": \"https://login.passtru.io/oauth/v2/keys\"\
          ,\n \"revocation_endpoint"
  /api/v1/public/apps/app_123/sessions:
    post:
      operationId: post_api_v1_public_apps_app_123_sessions
      tags:
      - Api
      summary: POST /api/v1/public/apps/app_123/sessions
      x-source: https://passtru.io/en/developers/public-api
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostApiV1PublicAppsApp123SessionsRequest'
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl -X POST \"https://api.passtru.io/api/v1/public/apps/app_123/sessions\"  -H \"Authorization: Bearer YOUR_PASSTRU_API_KEY\"\
          \  -H \"Idempotency-Key: idem_create_session_20260607_001\"  -H \"Content-Type: application/json\"  -d '{\n \"app_id\": \"app_123\"\
          ,\n \"external_reference\": \"case_789\",\n \"mode\": \"hosted\",\n \"requested_checks\": [\"identity\"],\n \"redirect_url\": \"https://example.com/passtru/return\"\
          ,\n \"webhook_e"
  /apps:
    get:
      operationId: get_apps
      tags:
      - Apps
      summary: List apps visible to the authenticated developer account.
      x-source: https://passtru.io/en/developers/public-api
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
    post:
      operationId: post_apps
      tags:
      - Apps
      summary: Create or validate an app. Requires Idempotency-Key.
      x-source: https://passtru.io/en/developers/public-api
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /apps/{appId}/credentials:
    post:
      operationId: post_apps_appId_credentials
      tags:
      - Apps
      summary: Reveal once or rotate credentials. Rotation requires Idempotency-Key.
      x-source: https://passtru.io/en/developers/public-api
      parameters:
      - name: appId
        in: path
        required: true
        schema:
          type: string
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /apps/{appId}/sessions:
    get:
      operationId: get_apps_appId_sessions
      tags:
      - Apps
      summary: List sessions for an app. Use page.next_cursor when page.has_more is true.
      x-source: https://passtru.io/en/developers/public-api
      parameters:
      - name: appId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
    post:
      operationId: post_apps_appId_sessions
      tags:
      - Apps
      summary: Create a hosted, iframe, or inline verification session. Requires Idempotency-Key.
      x-source: https://passtru.io/en/developers/public-api
      parameters:
      - name: appId
        in: path
        required: true
        schema:
          type: string
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /apps/{appId}/sessions/{sessionId}:
    delete:
      operationId: delete_apps_appId_sessions_sessionId
      tags:
      - Apps
      summary: Cancel a non-terminal session.
      x-source: https://passtru.io/en/developers/public-api
      parameters:
      - name: appId
        in: path
        required: true
        schema:
          type: string
      - name: sessionId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /apps/{appId}/webhooks/replay:
    post:
      operationId: post_apps_appId_webhooks_replay
      tags:
      - Apps
      summary: Replay an owned event or sandbox fixture by event_id.
      x-source: https://passtru.io/en/developers/webhooks
      parameters:
      - name: appId
        in: path
        required: true
        schema:
          type: string
      responses:
        '201':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostAppsAppidWebhooksReplayResponse'
      x-evidence:
        kind: documentation
  /apps/{appId}/webhooks/test:
    post:
      operationId: post_apps_appId_webhooks_test
      tags:
      - Apps
      summary: Build a signed test event and public headers for your receiver.
      x-source: https://passtru.io/en/developers/webhooks
      parameters:
      - name: appId
        in: path
        required: true
        schema:
          type: string
      responses:
        '201':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostAppsAppidWebhooksTestResponse'
      x-evidence:
        kind: documentation
  /auth/callback:
    get:
      operationId: get_auth_callback
      tags:
      - Auth
      summary: GET /auth/callback receives the authorization code after the user authenticates and consents.
      x-source: https://passtru.io/en/developers/express
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /auth/login:
    get:
      operationId: get_auth_login
      tags:
      - Auth
      summary: GET /auth/login initiates the OIDC flow.
      x-source: https://passtru.io/en/developers/express
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /auth/logout:
    get:
      operationId: get_auth_logout
      tags:
      - Auth
      summary: GET /auth/logout clears the local session.
      x-source: https://passtru.io/en/developers/express
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /oauth/v2/authorize:
    get:
      operationId: get_oauth_v2_authorize
      tags:
      - Oauth
      summary: Authorization Endpoint initiates the OIDC Authorization Code + PKCE flow.
      x-source: https://passtru.io/en/developers/api-endpoints
      parameters:
      - name: client_id
        in: query
        required: true
        schema:
          type: string
      - name: redirect_uri
        in: query
        required: true
        schema:
          type: string
      - name: response_type
        in: query
        required: true
        schema:
          type: string
      - name: scope
        in: query
        required: true
        schema:
          type: string
      - name: code_challenge
        in: query
        required: true
        schema:
          type: string
      - name: code_challenge_method
        in: query
        required: true
        schema:
          type: string
      - name: state
        in: query
        required: false
        schema:
          type: string
      - name: nonce
        in: query
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /oauth/v2/keys:
    get:
      operationId: get_oauth_v2_keys
      tags:
      - Oauth
      summary: GET /oauth/v2/keys
      x-source: https://passtru.io/en/developers/api-endpoints
      responses:
        '200':
          description: Success (shape read from the example response on the page)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetOauthV2KeysResponse'
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl https://login.passtru.io/oauth/v2/keys\nExample response\n{\n \"keys\": [\n {\n \"kty\": \"RSA\",\n \"use\": \"sig\",\n\
          \ \"alg\": \"RS256\",\n \"kid\": \"240301-rsa-sig\",\n \"n\": \"0vx7agoebGcQSuuPiLJXZpt...\",\n \"e\": \"AQAB\"\n }\n ]\n}\n`kty` —\
          \ string — Key type. RSA for RSA keys.\n`use` — string — Key usage. sig indicates this key is used for signatures.\n`alg` — string —\
          \ Algorithm. RS256 (RSASSA-PKCS1-v1_5 using SHA-256).\n`kid"
  /oauth/v2/revoke:
    post:
      operationId: post_oauth_v2_revoke
      tags:
      - Oauth
      summary: POST /oauth/v2/revoke
      x-source: https://passtru.io/en/developers/api-endpoints
      responses:
        '201':
          description: Success (shape read from the example response on the page)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostOauthV2RevokeResponse'
      x-evidence:
        kind: code-example
        language: curl
        snippet: 'curl -X POST https://login.passtru.io/oauth/v2/revoke  -H "Content-Type: application/x-www-form-urlencoded"  -d "token=eyJhbGci..."  -d
          "token_type_hint=access_token"  -d "client_id=YOUR_CLIENT_ID"  -d "client_secret=YOUR_CLIENT_SECRET"

          Response

          Returns 200 OK with an empty body on success. The endpoint returns 200 OK even if the token was already expired or invalid, per RFC
          7009. This prevents to'
  /oauth/v2/token:
    post:
      operationId: post_oauth_v2_token
      tags:
      - Oauth
      summary: POST /oauth/v2/token
      x-source: https://passtru.io/en/developers/api-endpoints
      responses:
        '201':
          description: Success (shape read from the example response on the page)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostOauthV2TokenResponse'
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl -X POST https://login.passtru.io/oauth/v2/token  -H \"Content-Type: application/x-www-form-urlencoded\"  -d \"grant_type=authorization_code\"\
          \  -d \"code=AUTHORIZATION_CODE\"  -d \"code_verifier=dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk\"  -d \"client_id=YOUR_CLIENT_ID\"\
          \  -d \"client_secret=YOUR_CLIENT_SECRET\"  -d \"redirect_uri=https://example.com/callback\"\nExample response\n{\n \"access_token\"\
          : \"eyJhbGci"
  /oidc/v1/end_session:
    get:
      operationId: get_oidc_v1_end_session
      tags:
      - Oidc
      summary: End Session (Logout) ends the user's session at Passtru.
      x-source: https://passtru.io/en/developers/api-endpoints
      parameters:
      - name: id_token_hint
        in: query
        required: false
        schema:
          type: string
      - name: post_logout_redirect_uri
        in: query
        required: false
        schema:
          type: string
      - name: state
        in: query
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /oidc/v1/userinfo:
    get:
      operationId: get_oidc_v1_userinfo
      tags:
      - Oidc
      summary: GET /oidc/v1/userinfo
      x-source: https://passtru.io/en/developers/api-endpoints
      responses:
        '200':
          description: Success (shape read from the example response on the page)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetOidcV1UserinfoResponse'
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl https://login.passtru.io/oidc/v1/userinfo  -H \"Authorization: Bearer eyJhbGci...\"\nExample response (scopes: `openid\
          \ profile email`)\n{\n \"sub\": \"283479261830045698\",\n \"email\": \"jane@example.com\",\n \"email_verified\": true,\n \"name\": \"\
          Jane Doe\",\n \"passtru_sub\": \"psu_8a3f1b7c9d2e4f6a0b1c3d5e7f8a9b0c\"\n}\nExample response (scopes: `openid email age_verification`)\n\
          {\n \"sub\": \"283479261830045698\",\n \"email"
  /receipts/verify:
    post:
      operationId: post_receipts_verify
      tags:
      - Receipts
      summary: Verify a supported receipt mode. Foundation-pending modes fail closed.
      x-source: https://passtru.io/en/developers/public-api
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /sessions/{sessionId}:
    get:
      operationId: get_sessions_sessionId
      tags:
      - Sessions
      summary: Read a verification session by ID.
      x-source: https://passtru.io/en/developers/public-api
      parameters:
      - name: sessionId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
components:
  schemas:
    GetWellKnownOpenidConfigurationResponse:
      type: object
      properties:
        issuer:
          type: string
        authorization_endpoint:
          type: string
        token_endpoint:
          type: string
        userinfo_endpoint:
          type: string
        jwks_uri:
          type: string
        revocation_endpoint:
          type: string
        end_session_endpoint:
          type: string
        scopes_supported:
          type: array
          items:
            type: string
        response_types_supported:
          type: array
          items:
            type: string
        grant_types_supported:
          type: array
          items:
            type: string
        code_challenge_methods_supported:
          type: array
          items:
            type: string
        subject_types_supported:
          type: array
          items:
            type: string
        id_token_signing_alg_values_supported:
          type: array
          items:
            type: string
    PostApiV1PublicAppsApp123SessionsRequest:
      type: object
      properties:
        app_id:
          type: string
        external_reference:
          type: string
        mode:
          type: string
        requested_checks:
          type: array
          items:
            type: string
        redirect_url:
          type: string
        webhook_endpoint:
          type: string
        metadata:
          type: object
          properties:
            case_type:
              type: string
    PostAppsAppidWebhooksReplayResponse:
      type: object
      properties:
        raw_body_sha256:
          type: string
          description: Hash of the returned test event body so clients can verify exact bytes.
    PostAppsAppidWebhooksTestResponse:
      type: object
      properties:
        raw_body_sha256:
          type: string
          description: Hash of the returned test event body so clients can verify exact bytes.
    GetOauthV2KeysResponse:
      type: object
      properties:
        keys:
          type: array
          items:
            type: object
            properties:
              kty:
                type: string
              use:
                type: string
              alg:
                type: string
              kid:
                type: string
              n:
                type: string
              e:
                type: string
    PostOauthV2RevokeResponse:
      type: object
      properties:
        keys:
          type: array
          items:
            type: object
            properties:
              kty:
                type: string
              use:
                type: string
              alg:
                type: string
              kid:
                type: string
              n:
                type: string
              e:
                type: string
    PostOauthV2TokenResponse:
      type: object
      properties:
        access_token:
          type: string
        token_type:
          type: string
        expires_in:
          type: integer
        id_token:
          type: string
        scope:
          type: string
    GetOidcV1UserinfoResponse:
      type: object
      properties:
        sub:
          type: string
        email:
          type: string
        email_verified:
          type: boolean
        name:
          type: string
        passtru_sub:
          type: string
  securitySchemes:
    bearer:
      type: http
      scheme: bearer
security:
- bearer: []
tags:
- name: API
- name: Api
- name: Apps
- name: Auth
- name: Oauth
- name: Oidc
- name: Receipts
- name: Sessions