Ready-Made Actions

Email/username + password sign-in. On success sets the access + refresh cookies and returns the user with token metadata (LoginSuccess).

Create an account. Enforces your password policy and, when email verification is on, leaves the account unverified until VERIFY_EMAIL.

Exchange the refresh cookie for a fresh access token. Not public out of the box — the action defaults to isPublic:false and the server only exposes it publicly when authentication.refresh.isPublic is set (needed for the auto-refresh-on-401 flow). When you front the API with the nucleus-core-ts/proxy (reverse proxy), it calls this automatically on a 401 and replays the request; the generated ApiCaller client itself does not retry — it surfaces the 401 to onErrorHandle.

The authenticated user with resolved roles and claims — the canonical 'am I signed in?' check used to hydrate app state.

Revoke the current session server-side and clear the auth cookies.

Change the password of a signed-in user (current + new password).

Set an initial password for accounts created without one (invited or passwordless users). Registered as always-public when passwordSet is enabled; its primary path consumes an emailed invite token, falling back to the x-user-id session only when no token is present.

Trigger a reset email containing a single-use token.

Consume the reset token and store the new password.

Confirm an email address with the token from the verification mail.

Re-send the verification email if the first one expired or was lost.

Email a one-time sign-in link to the address provided.

Exchange a magic-link token for a full session (LoginSuccess).

Invite a user by email from inside the app (admin-side).

Accept an invitation and provision the invited account.

Issue a captcha challenge to attach to a sensitive form.

Validate the user's captcha answer before allowing the action.

Every active session/device for the current user.

Details of the session making this request (device, IP, last seen).

Summary counts — active, pending and total sessions.

New-device sign-ins awaiting approval from a trusted device.

Approve or reject a pending device by id. Registered as always-public whenever sessions are enabled: they authenticate via the emailed approval token, not a session cookie, so an existing trusted device can approve/reject a pending sign-in without the caller holding a session.

Sign out a single session/device by id.

Sign out everywhere at once (optionally keeping the current device).

List another user's active sessions by user id — the admin-side counterpart to SESSIONS, for offboarding and lost-device response. Guarded by godmin or a role named in authentication.sessions.adminRoles.

Revoke another user's sessions by user id (same godmin + adminRoles guard). Ends all of that user's active sessions, or a single one when a sessionId is passed in the body; the audit row records the acting admin, not the subject.

Get the creation options to pass to navigator.credentials.create().

Verify the attestation and persist the new passkey.

Get assertion options to pass to navigator.credentials.get() at sign-in.

Verify the assertion and issue a session — passwordless login.

List the user's registered passkeys with metadata.

Rename or remove an individual passkey.

List the OAuth providers configured on the server so the UI can render sign-in buttons.

Begin the OAuth flow for a provider — redirects the browser to the provider's consent screen (the provider's :provider/callback is also public).

List the OAuth accounts linked to the signed-in user.

Disconnect a linked provider from the signed-in user's account.

Mint a new API key for the signed-in user (the raw secret is returned once).

List the current user's API keys with metadata (never the raw secret).

Fetch a single API key's metadata by id.

Update an API key by id (e.g. rename or adjust its settings).

Revoke an API key by id, immediately invalidating it.

Create a user directly, bypassing self-registration.

Full cohort lifecycle — list, read one (with its users), create, update and delete a cohort. Emitted only when authentication.cohorts.enabled.

Create many users at once into a cohort — explicit list or generated from a prefix/domain/count — returning created, skipped and generated passwords. Emitted only when authentication.cohorts.enabled.

Bulk membership operations on a cohort — activate or deactivate all its users, delete its users, and export the cohort. Emitted only when authentication.cohorts.enabled.

Re-key a user's id and cascade the change across references.

Permanently delete a user (as opposed to the default soft delete).

Start acting as another user, then return to your own identity.

Full CRUD for scoped API keys — machine clients authenticate with a key instead of a session cookie. Emitted only when authentication.apiKeys.enabled.

Live availability check while the user types a subdomain at signup.

Self-serve tenant creation — provisions a schema and first admin.

Admin-side provisioning of a new tenant (schema + seed).

Browse all tenants or load one with its status and metadata.

Disable or restore a tenant's access without deleting its data.

Records awaiting your approval across every verification flow. Emitted only when verification.enabled.

Where a specific record sits in its approval graph. Emitted only when verification.enabled.

Approve or reject the current step, with an optional signature/comment. Emitted only when verification.enabled.

Start a flow for a record (by flow_id or auto-selected), read a record's decision history, and list statuses for an entity type. Emitted only when verification.enabled.

List and read, then author, publish and remove the verification flow graphs themselves. Emitted only when verification.enabled AND verification.flowEndpoints.enabled.

Read in-app notifications and the unread count, and mark one or all as seen — the portal notification center. Emitted only when verification.enabled AND notification.enabled AND notification.endpoints.enabled.

Health check, the live activity feed, and read/tune live-monitoring settings. Emitted only when liveMonitoring.enabled.

Inspect the live config with secrets masked, section by section.

Hot-patch a reloadable section; the response says if a restart is required.

See which env-var references resolved, manage runtime overrides, and schedule a graceful restart.

List your conversations (limit/offset), start a new 1:1 or group conversation, and load one by id.

Page a conversation's messages (limit/before cursor) and post a new message into it.

Mark the conversation read (optionally up to a messageId) and broadcast a typing indicator.

Add users to a group conversation or remove a single participant.

Edit a message's content or delete it.

Resolve a hostname to its tenant/owner — the public lookup used at request routing.

Attach a custom hostname, list attached hostnames (by owner/tenant), and load one by id.

Read the DNS records to set, trigger ownership/SSL verification, and refresh the live status.

Activate or disable a verified hostname, and promote one to the tenant's primary domain.

Start a managed domain registration (Domain Concierge), list registrations, and load one by id.

Cancel a pending registration or transfer a managed domain out to another registrar.

Record a commission split into the immutable ledger and list splits (by recipient/status).

Read an owner's available/reserved balance and release a risk reserve back to available.

Read and upsert the delayed-settlement policy (hold window, reserve rate) for an owner.

Request a payout of available balance, list payout requests (by recipient/status), and load one.

Approve or reject a pending payout request in the operator workflow.

Open a dispute, list disputes (by owner/status), and resolve one (won/lost/accepted/cancelled).

List or fetch with StandardQueryParams; returns a typed StandardReturn.

Example: GET_PRODUCTS, GET_ORDERS

Create a record from a payload typed to that entity's columns.

Example: ADD_PRODUCT

Fetch a single record by id (typed StandardReturn).

Example: GET_PRODUCT_BY_ID

Distinct values of a readable field (authz + sensitive-column guarded).

Example: GET_PRODUCTS_DISTINCT

Full (PUT) or partial (PATCH) update of a record by id.

Example: UPDATE_PRODUCT, PATCH_PRODUCT

Delete a record (soft or hard per your entity config).

Example: DELETE_PRODUCT

Insert, update or delete many rows in one request (bulk endpoints). Emitted only when the entity sets bulk_endpoints_enabled.

Example: BULK_ADD_PRODUCTS, BULK_UPDATE_PRODUCTS, BULK_DELETE_PRODUCTS

The same CRUD set — EXCEPT the /distinct action, which is generated only for your declared entities — is pre-generated for the 11 built-in tables (profiles, addresses, phones, files, users, roles, claims, user_roles, role_claims, audit_logs, monitoring_metrics). Action keys follow the SAME table-name derivation as declared entities, so they are NOT the PascalCase names: the users table yields GET_USERS / ADD_USER / GET_USER_BY_ID / UPDATE_USER / PATCH_USER / DELETE_USER, roles yields GET_ROLES / ADD_ROLE / …, audit_logs yields GET_AUDIT_LOGS, and so on. The 'SystemUser / SystemRole / SystemClaim / …' PascalCase names are the TypeScript entity/type aliases only (e.g. SystemUserEntity = InferEntity<SystemTables, 'users'>), never the runtime action keys. Note: generic-CRUD WRITES are godmin-locked for two groups of tables — (1) the RBAC tables among the 11 (roles, claims, user_roles, role_claims), and (2) sensitive system/feature tables: custom-domain routing (domain_hostnames, domain_registrations, domain_provider_records, domain_verification_challenges, domain_events), every payment_* money table, verifications, and auth-secret/session tables (api_keys, magic_link_tokens, user_sessions, trusted_devices). ADD/UPDATE/PATCH/DELETE to any of these return 403 for a non-godmin caller; legitimate owner writes go through the dedicated hardened routes (the authorization APIs, /domains/hostnames, /sub-merchants, /invoices, /subscriptions, /cards, …).

Example: GET_USERS, ADD_USER, GET_USER_BY_ID, UPDATE_USER, PATCH_USER, DELETE_USER, GET_ROLES, ADD_ROLE, GET_AUDIT_LOGS