CorebanqCorebanq Developer Docs
Authv1Authentication

Logout

Invalidate tokens and end session

POST
/v1/logout

Authorization

AuthorizationBearer <token>

In: header

Response Body

application/json

curl -X POST "https://example.com/v1/logout"
{
  "message": "string"
}

POSTAdmin Login

Authenticate admin user with Internal role. When the user's mfa_mode is off, the response includes authenticated session artifacts and the refresh token cookie is scoped to the provided X-App-ID. When mfa_mode requires MFA, the initial response is challenge-only until /v1/verify-2FA succeeds. Internal users with mfa_mode totp and no TOTP secret receive credential_type totp_setup_required until TOTP enrollment completes.

POSTRefresh token

Get new access token using refresh token. The X-App-ID header must match the value used during authentication; a mismatch revokes the refresh token. The Authorization header must contain an authenticated access token (`sub=user_auth`); MFA challenge tokens are rejected.