Type: reference · Imported reference (adopted from the clarity backend developer docs)
Login, registration, session info, and admin user management. See the API conventions for the auth model and error shapes, and the API server for the security model.
/exactapi/registerPublic (no auth). Rate-limited per email. New accounts always receive the read-write role with empty hierarchy grants (no data access until an admin assigns scope).
Request body
| Field | Type | Required | Notes |
|---|---|---|---|
name |
string | optional | Defaults to "". |
email |
string | optional | Defaults to "". |
password |
string | optional | Defaults to "". |
{ "name": "Ada Lovelace", "email": "ada@example.com", "password": "s3cret!" }
Response — always HTTP 200; success is in the body.
{ "success": true, "message": "User Registered" }
{ "success": false, "error": "Registration Failed: EmailAlreadyExists" }
/exactapi/loginPublic (no auth). Rate-limited per email; the account locks after too many failed attempts (~15 minutes).
Request body
| Field | Type | Required |
|---|---|---|
email |
string | yes |
password |
string | yes |
name |
string | optional |
{ "email": "ada@example.com", "password": "s3cret!" }
Response
200:{ "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." }
401:{ "error": "Invalid username or password" }
Use the returned token as Authorization: Bearer <token> on subsequent requests.
/exactapi/meAuth required. No body. Returns the caller's identity from the token.
{ "user_id": "ada@example.com", "role": "read-write" }
(user_id is the JWT sub, role is the JWT role.)
/exactapi/me/detailsAuth required. No body. Reports whether the caller's unit has a configured default collection.
{ "unitConfigured": true }
/exactapi/admin/user/deleteAdmin only. Deletes a user by email.
Request body
| Field | Type | Required |
|---|---|---|
email |
string | yes (400 if empty) |
{ "email": "olduser@example.com" }
Response
| Status | Body |
|---|---|
| 200 | { "success": true } |
| 400 | { "error": "email required" } |
| 404 | { "error": "user not found" } |
| 500 | { "error": "delete failed" } |
| — | Non-admin token → auth rejection. |
Creating, listing, and updating users (and assigning access scope on userprofiles) is done through the generic entity CRUD API — see Entity CRUD. Notes specific to users:
users has real columns email, password, username. The password is never returned (skipped on serialization) and is Argon2id-hashed on write.userprofiles.accessAllowed (sites + units).
POST /exactapi/update_password(admin password reset) exists in code but is not currently mounted.
Adopted from clarity backend developer docs (
docs/developer/api/auth-users.md), imported reference.
Primary handlers:clarity:backend/src-tauri/src/main.rs:3799-3847(register/login),clarity:backend/src-tauri/src/auth.rs.
Last updated: 2026-07-16 from clarity@bff451d