Account

Generated from Huudis's own code: every route in this area, what it takes and how to call it.

Method Path What it does
DELETE /api/v1/account Delete account
GET /api/v1/account List account
PATCH /api/v1/account Update account
GET /api/v1/account/audit List audit
GET /api/v1/account/billing /billing surface for the Huudis dashboard.
POST /api/v1/account/billing/cancel Create a cancel
POST /api/v1/account/billing/checkout Create a checkout
GET /api/v1/account/billing/invoices List invoices
GET /api/v1/account/billing/plans Public to authenticated sessions — no account scope needed since every user sees the same plans.
GET /api/v1/account/billing/usage List usage
POST /api/v1/account/cancel-deletion Create a cancel deletion
GET /api/v1/account/connected-apps Signal = RefreshToken, not OidcConsent.
POST /api/v1/account/connected-apps/{clientId}/revoke Revoke every live refresh-token family this user holds for the client.
DELETE /api/v1/account/connected-apps/{id} Legacy consent-id path.
POST /api/v1/account/email-change Create an email change
GET /api/v1/account/linked-accounts List linked accounts
DELETE /api/v1/account/linked-accounts/{provider} Delete a linked account
POST /api/v1/account/password-change Create a password change
POST /api/v1/account/schedule-deletion Self-serve soft-delete: stamps a 30-day grace marker.
GET /api/v1/account/services List services
POST /api/v1/account/services/disable Create a disable
POST /api/v1/account/services/enable Create an enable
GET /api/v1/account/sessions List sessions
POST /api/v1/account/sessions/{id}/revoke Revoke a session
POST /api/v1/account/sessions/revoke-all Create a revoke all
GET /api/v1/account/social-providers List social providers
DELETE /api/v1/account/social-providers/{provider} Delete a social provider
PUT /api/v1/account/social-providers/{provider} Replace a social provider
GET /api/v1/account/webhook-subscriptions List webhook subscriptions
POST /api/v1/account/webhook-subscriptions Create a webhook subscription
DELETE /api/v1/account/webhook-subscriptions/{id} Delete a webhook subscription
GET /api/v1/account/webhook-subscriptions/{id} Get a webhook subscription
PATCH /api/v1/account/webhook-subscriptions/{id} Update a webhook subscription
GET /api/v1/account/webhook-subscriptions/{id}/deliveries List deliveries
POST /api/v1/account/webhook-subscriptions/{id}/rotate-secret Rotate secret a webhook subscription
POST /api/v1/account/webhook-subscriptions/deliveries/{id}/replay Replay a delivery
GET /api/v1/account/webhook-subscriptions/events/catalog List catalog
GET /api/v1/account/workspaces List workspaces
POST /api/v1/account/workspaces Create a workspace
PATCH /api/v1/account/workspaces/{id} Update a workspace
POST /api/v1/account/workspaces/{id}/cancel-deletion Cancel deletion a workspace
GET /api/v1/account/workspaces/{id}/members Additive, read-only.
POST /api/v1/account/workspaces/{id}/schedule-deletion Owner-only soft-delete: stamps a 30-day grace marker on the workspace.
POST /api/v1/account/workspaces/{id}/switch Switch a workspace

Delete account

DELETE /api/v1/account

Authentication: Takes a signed-in person's session or bearer token only. An access key is refused (PERSON_ONLY): this route deletes the person's account or workspace (every Forjio product's data for it).

Body

Field Type Required Notes
password string no min length 1; max length 200

Example

curl -X DELETE "https://huudis.com/api/v1/account" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{"password":"…"}'

List account

GET /api/v1/account

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:GetAccount. See access keys.

Example

curl -X GET "https://huudis.com/api/v1/account" \
  -H "Authorization: Bearer <access token>"

Update account

PATCH /api/v1/account

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:UpdateAccount. See access keys.

Body

Field Type Required Notes
name string no max length 120; may be null
locale string no max length 10

Example

curl -X PATCH "https://huudis.com/api/v1/account" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{"name":"…","locale":"…"}'

List audit

GET /api/v1/account/audit

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:ListAuditEvents. See access keys.

Query parameters

Name Type Required Notes
limit integer no min 1; max 200
cursor string no
event string no
outcome success or failure or denied no
since string (date-time) no
until string (date-time) no

Example

curl -X GET "https://huudis.com/api/v1/account/audit" \
  -H "Authorization: Bearer <access token>"

/billing surface for the Huudis dashboard.

GET /api/v1/account/billing

/billing surface for the Huudis dashboard. Each route scopes to the session's activeAccountId — you can only manage billing for the Account you're currently viewing.

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:GetSubscription. See access keys.

Example

curl -X GET "https://huudis.com/api/v1/account/billing" \
  -H "Authorization: Bearer <access token>"

Create a cancel

POST /api/v1/account/billing/cancel

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:CancelSubscription. See access keys.

Example

curl -X POST "https://huudis.com/api/v1/account/billing/cancel" \
  -H "Authorization: Bearer <access token>"

Create a checkout

POST /api/v1/account/billing/checkout

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:CreateCheckout. See access keys.

Body

Field Type Required Notes
tier pro or business or scale yes

Example

curl -X POST "https://huudis.com/api/v1/account/billing/checkout" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{"tier":"pro"}'

List invoices

GET /api/v1/account/billing/invoices

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:ListInvoices. See access keys.

Example

curl -X GET "https://huudis.com/api/v1/account/billing/invoices" \
  -H "Authorization: Bearer <access token>"

Public to authenticated sessions — no account scope needed since every user sees the same plans.

GET /api/v1/account/billing/plans

Public to authenticated sessions — no account scope needed since every user sees the same plans.

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:ListPlans. See access keys.

Example

curl -X GET "https://huudis.com/api/v1/account/billing/plans" \
  -H "Authorization: Bearer <access token>"

List usage

GET /api/v1/account/billing/usage

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:GetUsage. See access keys.

Example

curl -X GET "https://huudis.com/api/v1/account/billing/usage" \
  -H "Authorization: Bearer <access token>"

Create a cancel deletion

POST /api/v1/account/cancel-deletion

Authentication: Takes a signed-in person's session or bearer token only. An access key is refused (PERSON_ONLY): this route is the other half of scheduling a deletion, which is person only.

Example

curl -X POST "https://huudis.com/api/v1/account/cancel-deletion" \
  -H "Authorization: Bearer <access token>"

Signal = RefreshToken, not OidcConsent.

GET /api/v1/account/connected-apps

Signal = RefreshToken, not OidcConsent. First-party Forjio clients (plugipay, storlaunch, …) skip the consent screen, so oidc_consents is empty for them — but every SSO login mints a refresh token for the client. So the distinct clients a user holds refresh tokens for == every product they've signed into. Tokens rotate (many rows per user+client), so we aggregate to distinct clients with first/last-use timestamps + an "active" flag (any live, unrevoked, unexpired token in the group).

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:ListConnectedApps. See access keys.

Example

curl -X GET "https://huudis.com/api/v1/account/connected-apps" \
  -H "Authorization: Bearer <access token>"

Revoke every live refresh-token family this user holds for the client.

POST /api/v1/account/connected-apps/{clientId}/revoke

Revoke every live refresh-token family this user holds for the client. Their access is cut off the next time they need a fresh access token, forcing a re-login for that app. Also clears any standing OIDC consent so the next sign-in re-prompts (no-op for first-party clients).

Authentication: Takes a signed-in person's session or bearer token only. An access key is refused (PERSON_ONLY): this route revokes the person's own sign-in grants.

Path parameters

Name Type Required Notes
clientId string yes

Example

curl -X POST "https://huudis.com/api/v1/account/connected-apps/:clientId/revoke" \
  -H "Authorization: Bearer <access token>"
DELETE /api/v1/account/connected-apps/{id}

Legacy consent-id path. Kept for backward compatibility with older clients; the RefreshToken-derived list above + the /:clientId/revoke endpoint are the current surface.

Authentication: Takes a signed-in person's session or bearer token only. An access key is refused (PERSON_ONLY): this route revokes the person's own sign-in grants.

Path parameters

Name Type Required Notes
id string yes

Example

curl -X DELETE "https://huudis.com/api/v1/account/connected-apps/:id" \
  -H "Authorization: Bearer <access token>"

Create an email change

POST /api/v1/account/email-change

Authentication: Takes a signed-in person's session or bearer token only. An access key is refused (PERSON_ONLY): this route changes how the person signs in.

Body

Field Type Required Notes
email string (email) yes max length 200
password string yes min length 1; max length 200

Example

curl -X POST "https://huudis.com/api/v1/account/email-change" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{"email":"…","password":"…"}'

List linked accounts

GET /api/v1/account/linked-accounts

Authentication: Takes a signed-in person's session or bearer token only. An access key is refused (PERSON_ONLY): this route lists the sign-in methods of the person.

Example

curl -X GET "https://huudis.com/api/v1/account/linked-accounts" \
  -H "Authorization: Bearer <access token>"

Delete a linked account

DELETE /api/v1/account/linked-accounts/{provider}

Authentication: Takes a signed-in person's session or bearer token only. An access key is refused (PERSON_ONLY): this route changes how the person signs in.

Path parameters

Name Type Required Notes
provider string yes

Example

curl -X DELETE "https://huudis.com/api/v1/account/linked-accounts/:provider" \
  -H "Authorization: Bearer <access token>"

Create a password change

POST /api/v1/account/password-change

Authentication: Takes a signed-in person's session or bearer token only. An access key is refused (PERSON_ONLY): this route changes how the person signs in.

Body

Field Type Required Notes
currentPassword string no min length 1; max length 200
newPassword string yes min length 10; max length 200

Example

curl -X POST "https://huudis.com/api/v1/account/password-change" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{"currentPassword":"…","newPassword":"…"}'

Self-serve soft-delete: stamps a 30-day grace marker.

POST /api/v1/account/schedule-deletion

Self-serve soft-delete: stamps a 30-day grace marker. The user STAYS signed-in-able during the window so they can cancel; the deletion worker hard-deletes (cascade) once the grace lapses.

Authentication: Takes a signed-in person's session or bearer token only. An access key is refused (PERSON_ONLY): this route deletes the person's account or workspace (every Forjio product's data for it).

Body

Field Type Required Notes
password string no min length 1; max length 200

Example

curl -X POST "https://huudis.com/api/v1/account/schedule-deletion" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{"password":"…"}'

List services

GET /api/v1/account/services

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:ListServices. See access keys.

Example

curl -X GET "https://huudis.com/api/v1/account/services" \
  -H "Authorization: Bearer <access token>"

Create a disable

POST /api/v1/account/services/disable

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:DisableService. See access keys.

Body

Field Type Required Notes
services array of string yes

Example

curl -X POST "https://huudis.com/api/v1/account/services/disable" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{"services":[]}'

Create an enable

POST /api/v1/account/services/enable

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:EnableService. See access keys.

Body

Field Type Required Notes
services array of string yes

Example

curl -X POST "https://huudis.com/api/v1/account/services/enable" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{"services":[]}'

List sessions

GET /api/v1/account/sessions

Authentication: Takes a signed-in person's session or bearer token only. An access key is refused (PERSON_ONLY): this route manages the person's sign-in sessions.

Example

curl -X GET "https://huudis.com/api/v1/account/sessions" \
  -H "Authorization: Bearer <access token>"

Revoke a session

POST /api/v1/account/sessions/{id}/revoke

Authentication: Takes a signed-in person's session or bearer token only. An access key is refused (PERSON_ONLY): this route manages the person's sign-in sessions.

Path parameters

Name Type Required Notes
id string yes

Example

curl -X POST "https://huudis.com/api/v1/account/sessions/:id/revoke" \
  -H "Authorization: Bearer <access token>"

Create a revoke all

POST /api/v1/account/sessions/revoke-all

Authentication: Takes a signed-in person's session or bearer token only. An access key is refused (PERSON_ONLY): this route manages the person's sign-in sessions.

Example

curl -X POST "https://huudis.com/api/v1/account/sessions/revoke-all" \
  -H "Authorization: Bearer <access token>"

List social providers

GET /api/v1/account/social-providers

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:ListSocialProviders. See access keys.

Example

curl -X GET "https://huudis.com/api/v1/account/social-providers" \
  -H "Authorization: Bearer <access token>"

Delete a social provider

DELETE /api/v1/account/social-providers/{provider}

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:DeleteSocialProvider. See access keys.

Path parameters

Name Type Required Notes
provider string yes

Example

curl -X DELETE "https://huudis.com/api/v1/account/social-providers/:provider" \
  -H "Authorization: Bearer <access token>"

Replace a social provider

PUT /api/v1/account/social-providers/{provider}

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:PutSocialProvider. See access keys.

Path parameters

Name Type Required Notes
provider string yes

Body

Field Type Required Notes
clientId string yes min length 1; max length 500
secret string no min length 1; max length 8000
redirectUri string (uri) no max length 500; may be null
teamId string no max length 64; may be null
keyId string no max length 64; may be null
enabled boolean no

Example

curl -X PUT "https://huudis.com/api/v1/account/social-providers/:provider" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{"clientId":"…","secret":"…","redirectUri":"…","teamId":"…","keyId":"…","enabled":false}'

List webhook subscriptions

GET /api/v1/account/webhook-subscriptions

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:ListWebhookSubscriptions. See access keys.

Example

curl -X GET "https://huudis.com/api/v1/account/webhook-subscriptions" \
  -H "Authorization: Bearer <access token>"

Create a webhook subscription

POST /api/v1/account/webhook-subscriptions

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:CreateWebhookSubscription. See access keys.

Body

Field Type Required Notes
url string (uri) yes
events array of string yes
description string no max length 200
active boolean no

Example

curl -X POST "https://huudis.com/api/v1/account/webhook-subscriptions" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{"url":"…","events":[],"description":"…","active":false}'

Delete a webhook subscription

DELETE /api/v1/account/webhook-subscriptions/{id}

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:DeleteWebhookSubscription. See access keys.

Path parameters

Name Type Required Notes
id string yes

Example

curl -X DELETE "https://huudis.com/api/v1/account/webhook-subscriptions/:id" \
  -H "Authorization: Bearer <access token>"

Get a webhook subscription

GET /api/v1/account/webhook-subscriptions/{id}

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:GetWebhookSubscription. See access keys.

Path parameters

Name Type Required Notes
id string yes

Example

curl -X GET "https://huudis.com/api/v1/account/webhook-subscriptions/:id" \
  -H "Authorization: Bearer <access token>"

Update a webhook subscription

PATCH /api/v1/account/webhook-subscriptions/{id}

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:UpdateWebhookSubscription. See access keys.

Path parameters

Name Type Required Notes
id string yes

Body

Field Type Required Notes
url string (uri) no
events array of string no
description string no max length 200; may be null
active boolean no

Example

curl -X PATCH "https://huudis.com/api/v1/account/webhook-subscriptions/:id" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{"url":"…","events":[],"description":"…","active":false}'

List deliveries

GET /api/v1/account/webhook-subscriptions/{id}/deliveries

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:ListWebhookDeliveries. See access keys.

Path parameters

Name Type Required Notes
id string yes

Query parameters

Name Type Required Notes
limit any no
status any no

Example

curl -X GET "https://huudis.com/api/v1/account/webhook-subscriptions/:id/deliveries" \
  -H "Authorization: Bearer <access token>"

Rotate secret a webhook subscription

POST /api/v1/account/webhook-subscriptions/{id}/rotate-secret

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:RotateWebhookSecret. See access keys.

Path parameters

Name Type Required Notes
id string yes

Example

curl -X POST "https://huudis.com/api/v1/account/webhook-subscriptions/:id/rotate-secret" \
  -H "Authorization: Bearer <access token>"

Replay a delivery

POST /api/v1/account/webhook-subscriptions/deliveries/{id}/replay

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:ReplayWebhookDelivery. See access keys.

Path parameters

Name Type Required Notes
id string yes

Example

curl -X POST "https://huudis.com/api/v1/account/webhook-subscriptions/deliveries/:id/replay" \
  -H "Authorization: Bearer <access token>"

List catalog

GET /api/v1/account/webhook-subscriptions/events/catalog

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:ListWebhookEvents. See access keys.

Example

curl -X GET "https://huudis.com/api/v1/account/webhook-subscriptions/events/catalog" \
  -H "Authorization: Bearer <access token>"

List workspaces

GET /api/v1/account/workspaces

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:ListWorkspaces. See access keys.

Example

curl -X GET "https://huudis.com/api/v1/account/workspaces" \
  -H "Authorization: Bearer <access token>"

Create a workspace

POST /api/v1/account/workspaces

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:CreateWorkspace. See access keys.

Body

Field Type Required Notes
name string yes min length 1; max length 120

Example

curl -X POST "https://huudis.com/api/v1/account/workspaces" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{"name":"…"}'

Update a workspace

PATCH /api/v1/account/workspaces/{id}

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:UpdateWorkspace. See access keys.

Path parameters

Name Type Required Notes
id string yes

Body

Field Type Required Notes
name string yes min length 1; max length 120

Example

curl -X PATCH "https://huudis.com/api/v1/account/workspaces/:id" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{"name":"…"}'

Cancel deletion a workspace

POST /api/v1/account/workspaces/{id}/cancel-deletion

Authentication: Takes a signed-in person's session or bearer token only. An access key is refused (PERSON_ONLY): this route is the other half of scheduling a deletion, which is person only.

Path parameters

Name Type Required Notes
id string yes

Example

curl -X POST "https://huudis.com/api/v1/account/workspaces/:id/cancel-deletion" \
  -H "Authorization: Bearer <access token>"

Additive, read-only.

GET /api/v1/account/workspaces/{id}/members

Additive, read-only. Only a MEMBER of the account may list its members — mirrors the NOT_A_MEMBER guard the mutating routes below use. Returns each member's email + name + role so consuming products (e.g. catentio's approval-gate picker) can offer real people by email rather than raw user ids.

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:ListWorkspaceMembers. See access keys.

Path parameters

Name Type Required Notes
id string yes

Example

curl -X GET "https://huudis.com/api/v1/account/workspaces/:id/members" \
  -H "Authorization: Bearer <access token>"

Owner-only soft-delete: stamps a 30-day grace marker on the workspace.

POST /api/v1/account/workspaces/{id}/schedule-deletion

Owner-only soft-delete: stamps a 30-day grace marker on the workspace. The workspace stays usable during the window; the deletion worker hard-deletes it (cascade) once the grace lapses.

Authentication: Takes a signed-in person's session or bearer token only. An access key is refused (PERSON_ONLY): this route deletes the person's account or workspace (every Forjio product's data for it).

Path parameters

Name Type Required Notes
id string yes

Example

curl -X POST "https://huudis.com/api/v1/account/workspaces/:id/schedule-deletion" \
  -H "Authorization: Bearer <access token>"

Switch a workspace

POST /api/v1/account/workspaces/{id}/switch

Authentication: Takes a signed-in person's session or bearer token only. An access key is refused (PERSON_ONLY): this route switches a sign-in session's workspace (a key names one per request with X-Huudis-Workspace-Id).

Path parameters

Name Type Required Notes
id string yes

Example

curl -X POST "https://huudis.com/api/v1/account/workspaces/:id/switch" \
  -H "Authorization: Bearer <access token>"
Huudis Docs · Account — reference | Huudis