Sintj API (1.30.0)

Returns the account id and email for the caller identified by the _sintj_session cookie.

Redirects the browser to Stytch's hosted OAuth start URL for the given tenant (identified by slug) and provider. Not JSON — a 302 browser redirect.

Reached twice in sequence for a single login: first at the fixed Stytch-registered redirect URI (shared across every tenant and region, since OAuth providers don't allow per-tenant redirect URIs), where the Cloudflare Worker rewrites the request into a 302 to this same path on the tenant's own host (subdomain or custom domain) — that hop is Worker-side and not a Rails request. Carries only token — Stytch validates redirect URLs by exact match including query string, so no other params can ride on it. The tenant is resolved from the organization_id in Stytch's authenticated response, and return_to (captured at /{provider}/start) travels in a short-lived cookie, not a query param. On the tenant's own host, Rails verifies the OAuth token via Stytch, finds-or-creates the local account, sets the real session cookie, and redirects to return_to. Not JSON — a 302 browser redirect.

Verifies the password against Stytch (not a locally-stored hash) for the given tenant's Organization. On success, sets the _sintj_session cookie and returns 204.

Clears the _sintj_session cookie. Idempotent — returns 204 whether or not a session cookie was present.

Returns 200 when the service is running. No authentication required.

Returns a tenant's full record including per-step onboarding status. Requires an internal service key — not exposed to end users.

Soft-deletes a tenant by setting deleted_at. Only disabled tenants may be deleted; attempting to delete an active tenant returns 422. Requires an internal service key — not exposed to end users.

Returns all provisioned tenants with their aggregate onboarding status. Requires an internal service key — not exposed to end users.

Creates a tenant record and seeds pending onboarding status rows. Requires an internal service key — not exposed to end users.

Sets a tenant's status to active. Idempotent — enabling an already-active tenant is a no-op and still returns 200. Requires an internal service key.

Sets a tenant's status to disabled. Idempotent — disabling an already-disabled tenant is a no-op and still returns 200. Requires an internal service key.

Returns the same {tenant_id, slug, host, region, allowed_auth_methods} record normally pushed to Cloudflare KV (Platform::SyncTenantKvService), so a local frontend/Worker (e.g. wrangler dev without --remote) can resolve tenant routing without real remote KV credentials. Public and unauthenticated, but development-environment only — returns 404 in every other environment. Never available in production.

Creates a new workspace under an existing tenant. Requires a valid X-Schema-Name header identifying the tenant schema.

Assigns an existing user to a workspace with a given role. Duplicate assignments are rejected with a 422 validation error. Requires a valid X-Schema-Name header.

Initiates the invitation flow for a new tenant user: creates a Stytch member, seeds a Tenant::User record with status "invited", and sends an invitation email. Not yet implemented — returns 501 until SIN-1329 is complete. Full contract (200 success + 422 validation error) added when SIN-1329 ships. Requires a valid X-Schema-Name header identifying the tenant schema.

Sets a tenant user's status to "active". Idempotent — enabling an already-active user succeeds. Requires a valid X-Schema-Name header identifying the tenant schema.

Sets a tenant user's status to "disabled", preventing login. Idempotent. Requires a valid X-Schema-Name header identifying the tenant schema.

Creates a Platform::User record (status: invited) and a mirrored Tenant::User in the tenant's Apartment schema, then sends an invitation email with an accept link. Guards: schema_provisioning step must be completed; no Platform::User may exist yet for this tenant. Requires an internal service key.

Validates the invitation token, sets the owner's password and name, flips both the Platform::User and Tenant::User to status active, and records invitation_accepted_at. No authentication header required — the token in the URL is the auth factor.

Partial update of the tenant's authentication policy settings. Only keys present in the request body are written; omitted keys are left unchanged. Unknown keys are silently ignored. The legacy mfa_required key is never written by this endpoint. Requires a valid X-Schema-Name header identifying the tenant schema.

Internal endpoint called by the central provisioning service to create an Apartment PostgreSQL schema for a tenant in this zone's database and seed OrgSettings defaults. Idempotent — returns 200 if the schema already exists. Authenticated via X-Service-JWT — never exposed to end users.