Accounts

Create Account

POST /v1/accounts

Creates a new user account. A Stripe customer is created and linked to the user. No payment method is collected at signup — resource billing runs on the per-project card added by the project's biller.

Auth: None (public)

Request Body:

{
  "name": "John Doe",
  "email": "[email protected]",
  "password": "securepassword"
}

Response (201):

{
  "success": true,
  "data": {
    "user": { "id": "...", "email": "[email protected]", "name": "John Doe" }
  }
}

Notes:

• Uses transactional rollback — if any step fails, all changes are reverted
• A Stripe customer is created with the user's email

Request Password Reset

POST /v1/accounts/restore

Sends a password reset email. Rate limited; repeated attempts return 429 RATE_LIMITED.

Auth: None (public)

Request Body:

{
  "email": "[email protected]",
  "locale": "en"
}

Response (200):

{
  "success": true,
  "data": null
}

Notes:

• Always returns 200 regardless of whether the email exists (prevents enumeration)
• Reset link points to FRONTEND_URL/reset-password

List Trusted Devices

GET /v1/account/two-factor/trusted-devices

Returns how many of your devices can currently sign in without a two-factor code, because "Trust this device for 30 days" was ticked on them.

Auth: Session

Response (200):

{
  "success": true,
  "data": { "count": 2 }
}

Revoke Trusted Devices

DELETE /v1/account/two-factor/trusted-devices

Revokes every trusted device on your account. The next sign-in on each of them — including the one making this request — asks for a two-factor code again.

Signing out does not revoke a trusted device; only this does. Use it whenever a device is lost or out of your control.

Auth: Session

Response (200):

{
  "success": true,
  "data": { "revoked": 2 }
}

Notes:

• Always scoped to your own account
• Safe to call when two-factor authentication is off, and when nothing is trusted (revoked is then 0)
• Revoking a trusted device does not end that device's session — the two are separate. Sessions are managed separately, and neither ends the other.