TrustLayer Auth API
The Auth API from TrustLayer — 1 operation(s) for auth.
Documentation
Documentation
https://developers.trustlayer.io/v2
Documentation
https://developers.trustlayer.io/v1/
OpenAPI Specification
openapi: 3.0.0
info:
title: TrustLayer Platform Auth API
version: '1.0'
contact:
name: TrustLayer Support
email: support@trustlayer.io
termsOfService: https://trustlayer.io/terms-of-service
externalDocs:
description: OpenAPI specification
url: /v1/platform-api.yaml
description: '3rd-party API for the TrustLayer platform.
**Deprecated.** Platform API v1 is deprecated as of 01 June 2026 and is
scheduled for sunset (end-of-life) on 31 March 2027. It remains fully
available until the sunset date but will not receive new features. Please
migrate to Platform API v2 for new integrations.
All v1 responses carry the standard deprecation response headers
([RFC 8594](https://www.rfc-editor.org/rfc/rfc8594)):
```http
Deprecation: @1780272000
Sunset: Wed, 31 Mar 2027 23:59:59 GMT
Link: <https://developers.trustlayer.io/>; rel="deprecation", <https://developers.trustlayer.io/>; rel="sunset"
```
`Deprecation: @1780272000` is the Unix timestamp for 2026-06-01T00:00:00Z;
sunset (end-of-life) is 2027-03-31T23:59:59 GMT.'
x-deprecated: true
x-deprecation-date: '2026-06-01'
x-sunset: '2027-03-31'
license:
name: Apache 2.0
url: https://apache.org/licenses/LICENSE-2.0
servers:
- url: http://localhost:4000/v1
description: Local
- url: https://api.trustlayer.io/v1
description: Production
security:
- API Key: []
tags:
- name: Auth
description: ''
paths:
/auth/sessions:
post:
tags:
- Auth
description: Create a 24-hour authorization session token for the workspace-management endpoints. The returned token grants `workspaces` write access for the authenticated user and is required as a Bearer credential on the `/v2/workspaces` routes. Returns 404 if no user matches the email and 401 if the password is invalid or the user is not a workspaces admin.
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
email:
description: Email address of the user creating the session.
type: string
password:
type: string
description: Password of the user creating the session.
required:
- email
- password
description: Credentials for creating an authorization session. The user must be flagged as a workspaces admin.
description: Credentials for creating an authorization session. The user must be flagged as a workspaces admin.
responses:
'201':
description: Newly issued 24-hour authorization session token granting workspaces write access.
content:
application/json:
schema:
type: object
properties:
token:
type: string
description: 'Bearer authorization token. Send as `Authorization: Bearer <token>` on subsequent calls. Expires in 24 hours.'
required:
- token
additionalProperties: false
description: Newly issued 24-hour authorization session token granting workspaces write access.
'400':
description: The request could not be understood — invalid body payload, unknown querystring filter, or a schema validation failure.
content:
application/json:
schema:
type: object
properties:
statusCode:
type: number
enum:
- 400
applicationCode:
type: string
description: Machine-readable error code. For application errors this is the ApplicationError.applicationCode (e.g. "FLOW.006"); for schema validation failures it is "FLOW.002" (InvalidData); for unexpected server failures it is "LIB.000".
message:
type: string
description: Human-readable error message.
details:
description: Optional additional context about the error.
required:
- statusCode
- applicationCode
- message
additionalProperties: false
description: The request could not be understood — invalid body payload, unknown querystring filter, or a schema validation failure.
'401':
description: Authentication failed — the bearer token is missing, malformed, expired, or does not grant access to this resource.
content:
application/json:
schema:
type: object
properties:
statusCode:
type: number
enum:
- 401
applicationCode:
type: string
description: Machine-readable error code. For application errors this is the ApplicationError.applicationCode (e.g. "FLOW.006"); for schema validation failures it is "FLOW.002" (InvalidData); for unexpected server failures it is "LIB.000".
message:
type: string
description: Human-readable error message.
details:
description: Optional additional context about the error.
required:
- statusCode
- applicationCode
- message
additionalProperties: false
description: Authentication failed — the bearer token is missing, malformed, expired, or does not grant access to this resource.
'403':
description: The authenticated caller does not have permission to perform this action on the target resource.
content:
application/json:
schema:
type: object
properties:
statusCode:
type: number
enum:
- 403
applicationCode:
type: string
description: Machine-readable error code. For application errors this is the ApplicationError.applicationCode (e.g. "FLOW.006"); for schema validation failures it is "FLOW.002" (InvalidData); for unexpected server failures it is "LIB.000".
message:
type: string
description: Human-readable error message.
details:
description: Optional additional context about the error.
required:
- statusCode
- applicationCode
- message
additionalProperties: false
description: The authenticated caller does not have permission to perform this action on the target resource.
'404':
description: The requested resource does not exist or is not visible to the authenticated caller.
content:
application/json:
schema:
type: object
properties:
statusCode:
type: number
enum:
- 404
applicationCode:
type: string
description: Machine-readable error code. For application errors this is the ApplicationError.applicationCode (e.g. "FLOW.006"); for schema validation failures it is "FLOW.002" (InvalidData); for unexpected server failures it is "LIB.000".
message:
type: string
description: Human-readable error message.
details:
description: Optional additional context about the error.
required:
- statusCode
- applicationCode
- message
additionalProperties: false
description: The requested resource does not exist or is not visible to the authenticated caller.
'500':
description: The server encountered an unexpected failure while processing the request.
content:
application/json:
schema:
type: object
properties:
statusCode:
type: number
enum:
- 500
applicationCode:
type: string
description: Machine-readable error code. For application errors this is the ApplicationError.applicationCode (e.g. "FLOW.006"); for schema validation failures it is "FLOW.002" (InvalidData); for unexpected server failures it is "LIB.000".
message:
type: string
description: Human-readable error message.
details:
description: Optional additional context about the error.
required:
- statusCode
- applicationCode
- message
additionalProperties: false
description: The server encountered an unexpected failure while processing the request.
components:
securitySchemes:
Token:
name: Authorization
type: apiKey
in: header
description: ''