Ops

Generated from Huudis's own code: every route in this area, what it takes and how to call it.

Method	Path	What it does
GET	/api/v1/ops/end-users	Workspace-scoped directory of end-users — people who have consented to an OIDC client owned by the active workspace.
GET	/api/v1/ops/end-users/{id}	Get an end user
POST	/api/v1/ops/end-users/{id}/impersonate	Impersonate an end user
POST	/api/v1/ops/end-users/{id}/revoke	Revoke an end user
POST	/api/v1/ops/end-users/{id}/send-password-reset	Send password reset an end user
POST	/api/v1/ops/end-users/{id}/verify-email	Verify email an end user
POST	/api/v1/ops/end-users/stop-impersonation	Create a stop impersonation

Workspace-scoped directory of end-users — people who have consented to an OIDC client owned by the active workspace.

GET /api/v1/ops/end-users

Workspace-scoped directory of end-users — people who have consented to an OIDC client owned by the active workspace. Used by Ibu Rina to see the cafe owners who signed into MejaStudio; used by Forjio inside the "Huudis" workspace to see every Huudis user (since every login goes through huudis-dashboard, one of Huudis's own clients). The global disable/enable routes below gate on requireForjioOps — the same Huudis-internal-workspace operator check the /ops/* admin routers use. (Previously an inline isForjioHuudisOps() helper.)

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:ListEndUsers. See access keys.

Example

curl -X GET "https://huudis.com/api/v1/ops/end-users" \
  -H "Authorization: Bearer <access token>"

Get an end user

GET /api/v1/ops/end-users/{id}

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:GetEndUser. See access keys.

Path parameters

Name	Type	Required	Notes
id	string	yes

Example

curl -X GET "https://huudis.com/api/v1/ops/end-users/:id" \
  -H "Authorization: Bearer <access token>"

Impersonate an end user

POST /api/v1/ops/end-users/{id}/impersonate

Authentication: Takes a signed-in person's session or bearer token only. An access key is refused (PERSON_ONLY): this route acts as another person.

Path parameters

Name	Type	Required	Notes
id	string	yes

Body

Field	Type	Required	Notes
durationSeconds	integer	no	default 1800; min 60; max 3600
reason	string	no	min length 1; max length 500

Example

curl -X POST "https://huudis.com/api/v1/ops/end-users/:id/impersonate" \
  -H "Authorization: Bearer <access token>" \
  -H "Content-Type: application/json" \
  -d '{"durationSeconds":1800,"reason":"…"}'

Revoke an end user

POST /api/v1/ops/end-users/{id}/revoke

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:RevokeEndUser. See access keys.

Path parameters

Name	Type	Required	Notes
id	string	yes

Example

curl -X POST "https://huudis.com/api/v1/ops/end-users/:id/revoke" \
  -H "Authorization: Bearer <access token>"

Send password reset an end user

POST /api/v1/ops/end-users/{id}/send-password-reset

Authentication: Takes a signed-in person's session or bearer token, or an IAM access key (Huudis-HMAC-SHA256) whose user's policies allow huudis:SendEndUserPasswordReset. See access keys.

Path parameters

Name	Type	Required	Notes
id	string	yes

Example

curl -X POST "https://huudis.com/api/v1/ops/end-users/:id/send-password-reset" \
  -H "Authorization: Bearer <access token>"

Verify email an end user

POST /api/v1/ops/end-users/{id}/verify-email

Authentication: Takes a signed-in person's session or bearer token only. An access key is refused (PERSON_ONLY): this route vouches for another person's email address (a sign-in credential) without proof.

Path parameters

Name	Type	Required	Notes
id	string	yes

Example

curl -X POST "https://huudis.com/api/v1/ops/end-users/:id/verify-email" \
  -H "Authorization: Bearer <access token>"

Create a stop impersonation

POST /api/v1/ops/end-users/stop-impersonation

Authentication: Takes a signed-in person's session or bearer token only. An access key is refused (PERSON_ONLY): this route ends a person's impersonation session.

Example

curl -X POST "https://huudis.com/api/v1/ops/end-users/stop-impersonation" \
  -H "Authorization: Bearer <access token>"