# Passtru API

**Canonical:** https://apis.io/apis/passtru/passtru-api/  
**Provider:** Passtru — https://apis.io/providers/passtru/  
**Base URL:** https://login.passtru.io  
**Documentation:** https://passtru.io/en/developers/public-api

Passtru API is published by [Passtru](https://apis.io/providers/passtru/) on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. This API exposes 6 JSON Schema definitions. The published artifact set on APIs.io includes an OpenAPI specification and 6 JSON Schemas.

Passtru API as documented publicly: 21 operations. Contract generated from the documentation by API Evangelist (2026-11-10); not the provider's own document.

## Operations (21)

| Method | Path | Summary |
|---|---|---|
| GET | `/.well-known/openid-configuration` | GET /.well-known/openid-configuration |
| POST | `/api/v1/public/apps/app_123/sessions` | POST /api/v1/public/apps/app_123/sessions |
| GET | `/apps` | List apps visible to the authenticated developer account. |
| POST | `/apps` | Create or validate an app. Requires Idempotency-Key. |
| POST | `/apps/{appId}/credentials` | Reveal once or rotate credentials. Rotation requires Idempotency-Key. |
| GET | `/apps/{appId}/sessions` | List sessions for an app. Use page.next_cursor when page.has_more is true. |
| POST | `/apps/{appId}/sessions` | Create a hosted, iframe, or inline verification session. Requires Idempotency-Key. |
| DELETE | `/apps/{appId}/sessions/{sessionId}` | Cancel a non-terminal session. |
| POST | `/apps/{appId}/webhooks/replay` | Replay an owned event or sandbox fixture by event_id. |
| POST | `/apps/{appId}/webhooks/test` | Build a signed test event and public headers for your receiver. |
| GET | `/auth/callback` | GET /auth/callback receives the authorization code after the user authenticates and consents. |
| GET | `/auth/login` | GET /auth/login initiates the OIDC flow. |
| GET | `/auth/logout` | GET /auth/logout clears the local session. |
| GET | `/oauth/v2/authorize` | Authorization Endpoint initiates the OIDC Authorization Code + PKCE flow. |
| GET | `/oauth/v2/keys` | GET /oauth/v2/keys |
| POST | `/oauth/v2/revoke` | POST /oauth/v2/revoke |
| POST | `/oauth/v2/token` | POST /oauth/v2/token |
| GET | `/oidc/v1/end_session` | End Session (Logout) ends the user's session at Passtru. |
| GET | `/oidc/v1/userinfo` | GET /oidc/v1/userinfo |
| POST | `/receipts/verify` | Verify a supported receipt mode. Foundation-pending modes fail closed. |
| GET | `/sessions/{sessionId}` | Read a verification session by ID. |

## Machine-readable artifacts (8)

- **OpenAPI** — https://artifacts.apis.io/passtru/openapi/_ae-authored/passtru-openapi-generated.yml
- **JSONSchema** — https://artifacts.apis.io/passtru/json-schema/passtru-get-well-known-openid-configuration-response-schema.json
- **JSONSchema** — https://artifacts.apis.io/passtru/json-schema/passtru-post-api-v1-public-apps-app123-sessions-request-schema.json
- **JSONSchema** — https://artifacts.apis.io/passtru/json-schema/passtru-get-oauth-v2-keys-response-schema.json
- **JSONSchema** — https://artifacts.apis.io/passtru/json-schema/passtru-post-oauth-v2-revoke-response-schema.json
- **JSONSchema** — https://artifacts.apis.io/passtru/json-schema/passtru-post-oauth-v2-token-response-schema.json
- **JSONSchema** — https://artifacts.apis.io/passtru/json-schema/passtru-get-oidc-v1-userinfo-response-schema.json
- **APIsJSON** — https://artifacts.apis.io/passtru/apis.yml

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/passtru/passtru-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/passtru/.