Docs/Account/API/Public Endpoints

Public Endpoints

These endpoints require no authentication. Use them to fetch tenant branding for custom login pages, retrieve password policy for client-side validation, and access OIDC discovery and JWKS for token verification.

Base URL: https://id.vyntech.com.au — No authentication required. These endpoints are designed to be called from public frontends and OIDC client libraries.

Checks if an email address is already registered within a tenant. Ideal for client-side registration wizards and multi-step login flows before form submission.

Check Email Availability

Check email existence or availability within a tenant (no auth required).

Payload Example

{
  "tenant_id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "email": "jane@acme-corp.com",
  "captcha_token": "0.AbCdEf123..."
}

Status Codes

Name
200
Type
HTTP
Description
Email availability checked successfully
Name
400
Type
HTTP
Description
Validation failed (invalid tenant UUID or email format)
Name
429
Type
HTTP
Description
Rate limit exceeded (too many verification requests)

Request Parameters

Name
tenant_id
Type
string
Required
Description
UUID of the tenant to check email uniqueness within.
Name
email
Type
string
Required
Description
The email address to check for existence or availability.
Name
captcha_token
Type
string
Description
Optional Cloudflare Turnstile / reCAPTCHA verification token if bot challenge is active.

Request

POST/api/v1/auth/check-email

Response 200

Returns branding configuration for a tenant by slug. Use this to render custom-branded login pages with the tenant's logo, colors, and company name.

Tenant Branding

Get a tenant's branding configuration (no auth required).

Status Codes

Name
200
Type
HTTP
Description
Branding returned
Name
404
Type
HTTP
Description
Tenant not found

Request

GET/public/branding/:slug

Response 200

Returns the password policy for a tenant. Use this to show password requirements on registration and change-password forms before the user submits.

Password Policy

Get a tenant's password policy (no auth required).

Status Codes

Name
200
Type
HTTP
Description
Password policy returned
Name
404
Type
HTTP
Description
Tenant not found

Request

GET/public/password-policy/:slug

Response 200

OpenID Connect Discovery document. Returns all supported endpoints, scopes, algorithms, and grant types. OIDC client libraries use this to auto-configure themselves.

OIDC Discovery

OpenID Connect Discovery document.

Status Codes

Name
200
Type
HTTP
Description
Discovery document returned

Request

GET/.well-known/openid-configuration

Response 200

Returns the public key(s) used to sign access tokens and ID tokens. Use these keys to verify JWT signatures in your backend. Cache this response and refresh periodically (keys may rotate).

JWKS (JSON Web Key Set)

JSON Web Key Set for token signature verification.

Status Codes

Name
200
Type
HTTP
Description
JWKS returned

Key rotation: Keys may be rotated periodically. During rotation, both old and new keys are served for 24 hours. Always match the kid from the JWT header to the correct key in the set. Most JWT libraries handle this automatically when configured with the JWKS URI.

Request

GET/.well-known/jwks.json

Response 200

What's Next

Authentication Flows →

Visual diagrams of login, MFA, and token verification flows.

OAuth 2.1 / OIDC Integration →

Full guide for integrating via OAuth 2.1 authorization code flow.

Settings API →

Configure tenant branding, password policies, and security settings.

Authentication API →