{
  "openapi": "3.1.1",
  "info": {
    "title": "ozProtect sso HTTP source reference",
    "version": "2026-10-28",
    "description": "Public user-facing source reference. Only explicitly permitted operations are published; service, maintenance and private interfaces are excluded. Unknown schemas stay unconstrained. Source checks do not replace authorization or establish runtime availability."
  },
  "servers": [
    {
      "url": "/",
      "description": "Select the actual assigned service origin; this is not a deployment URL."
    }
  ],
  "paths": {
    "/auth/login": {
      "post": {
        "operationId": "sso_post__auth_login",
        "tags": [
          "auth/login"
        ],
        "summary": "POST /auth/login",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained. SSO browser auth: credentialed CORS and shared session/rate-limit state. No browser application keys.",
        "parameters": [
          {
            "name": "Origin",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Must be in configured SSO_CORS_ORIGINS."
          }
        ],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.sso",
          "file": "src/auth/routes.js",
          "line": 102
        },
        "x-source-checks": [],
        "x-observed-required-input": [],
        "x-observed-errors": [
          "auth_error",
          "incorrect_data",
          "too_many_requests",
          "user_blocked",
          "user_deleted"
        ],
        "x-feature-keys": [],
        "x-internal": false,
        "requestBody": {
          "required": true,
          "description": "Keyless browser router parses JSON only. Authentication uses the HttpOnly cookie; credentials are not query parameters.",
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "login": {
                    "type": "string",
                    "minLength": 1,
                    "maxLength": 128
                  },
                  "password": {
                    "type": "string",
                    "minLength": 1,
                    "maxLength": 256,
                    "writeOnly": true
                  }
                },
                "required": [
                  "login",
                  "password"
                ],
                "additionalProperties": true
              }
            }
          }
        }
      }
    },
    "/auth/session": {
      "get": {
        "operationId": "sso_get__auth_session",
        "tags": [
          "auth/session"
        ],
        "summary": "GET /auth/session",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained. SSO browser auth: credentialed CORS and shared session/rate-limit state. No browser application keys.",
        "parameters": [],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.sso",
          "file": "src/auth/routes.js",
          "line": 130
        },
        "x-source-checks": [],
        "x-observed-required-input": [],
        "x-observed-errors": [
          "token_invalid"
        ],
        "x-feature-keys": [],
        "x-internal": false,
        "security": [
          {
            "SsoCookie": []
          }
        ]
      }
    },
    "/auth/logout": {
      "post": {
        "operationId": "sso_post__auth_logout",
        "tags": [
          "auth/logout"
        ],
        "summary": "POST /auth/logout",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained. SSO browser auth: credentialed CORS and shared session/rate-limit state. No browser application keys.",
        "parameters": [
          {
            "name": "Origin",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Must be in configured SSO_CORS_ORIGINS."
          },
          {
            "name": "X-CSRF-Token",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Session-bound token returned by login/session."
          }
        ],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.sso",
          "file": "src/auth/routes.js",
          "line": 136
        },
        "x-source-checks": [],
        "x-observed-required-input": [],
        "x-observed-errors": [
          "access_denied"
        ],
        "x-feature-keys": [],
        "x-internal": false,
        "security": [
          {
            "SsoCookie": []
          }
        ],
        "requestBody": {
          "required": false,
          "description": "Keyless browser router parses JSON only. Authentication uses the HttpOnly cookie; credentials are not query parameters.",
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {},
                "additionalProperties": true
              }
            }
          }
        }
      }
    },
    "/auth/profile": {
      "get": {
        "operationId": "sso_get__auth_profile",
        "tags": [
          "auth/profile"
        ],
        "summary": "GET /auth/profile",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained. SSO browser auth: credentialed CORS and shared session/rate-limit state. No browser application keys.",
        "parameters": [],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.sso",
          "file": "src/auth/routes.js",
          "line": 146
        },
        "x-source-checks": [],
        "x-observed-required-input": [],
        "x-observed-errors": [
          "token_invalid"
        ],
        "x-feature-keys": [],
        "x-internal": false,
        "security": [
          {
            "SsoCookie": []
          }
        ]
      }
    },
    "/auth/projects": {
      "get": {
        "operationId": "sso_get__auth_projects",
        "tags": [
          "auth/projects"
        ],
        "summary": "GET /auth/projects",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained. SSO browser auth: credentialed CORS and shared session/rate-limit state. No browser application keys.",
        "parameters": [],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.sso",
          "file": "src/auth/routes.js",
          "line": 164
        },
        "x-source-checks": [],
        "x-observed-required-input": [],
        "x-observed-errors": [
          "token_invalid"
        ],
        "x-feature-keys": [],
        "x-internal": false,
        "security": [
          {
            "SsoCookie": []
          }
        ]
      }
    },
    "/auth/network-token": {
      "post": {
        "operationId": "sso_post__auth_network_token",
        "tags": [
          "auth/network-token"
        ],
        "summary": "POST /auth/network-token",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained. SSO browser auth: credentialed CORS and shared session/rate-limit state. No browser application keys.",
        "parameters": [
          {
            "name": "Origin",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Must be in configured SSO_CORS_ORIGINS."
          },
          {
            "name": "X-CSRF-Token",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Session-bound token returned by login/session."
          }
        ],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.sso",
          "file": "src/auth/routes.js",
          "line": 170
        },
        "x-source-checks": [],
        "x-observed-required-input": [],
        "x-observed-errors": [
          "access_denied",
          "incorrect_data",
          "token_invalid",
          "unknown_error"
        ],
        "x-feature-keys": [],
        "x-internal": false,
        "security": [
          {
            "SsoCookie": []
          }
        ],
        "requestBody": {
          "required": true,
          "description": "Keyless browser router parses JSON only. Authentication uses the HttpOnly cookie; credentials are not query parameters.",
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "project_id": {
                    "type": "integer",
                    "minimum": 1
                  },
                  "server_id": {
                    "type": "integer",
                    "minimum": 1
                  }
                },
                "required": [
                  "project_id",
                  "server_id"
                ],
                "additionalProperties": true
              }
            }
          }
        }
      }
    },
    "/auth/steam/start": {
      "get": {
        "operationId": "sso_get__auth_steam_start",
        "tags": [
          "auth/steam"
        ],
        "summary": "GET /auth/steam/start",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained. SSO browser auth: credentialed CORS and shared session/rate-limit state. No browser application keys.",
        "parameters": [
          {
            "name": "mode",
            "in": "query",
            "required": false,
            "schema": {
              "description": "Read by source. No type is asserted without an explicit reviewed schema."
            }
          }
        ],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.sso",
          "file": "src/auth/routes.js",
          "line": 232
        },
        "x-source-checks": [],
        "x-observed-required-input": [],
        "x-observed-errors": [
          "too_many_requests",
          "unknown_error"
        ],
        "x-feature-keys": [],
        "x-internal": false
      }
    },
    "/auth/steam/callback": {
      "get": {
        "operationId": "sso_get__auth_steam_callback",
        "tags": [
          "auth/steam"
        ],
        "summary": "GET /auth/steam/callback",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained. SSO browser auth: credentialed CORS and shared session/rate-limit state. No browser application keys.",
        "parameters": [
          {
            "name": "state",
            "in": "query",
            "required": false,
            "schema": {
              "description": "Read by source. No type is asserted without an explicit reviewed schema."
            }
          }
        ],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.sso",
          "file": "src/auth/routes.js",
          "line": 250
        },
        "x-source-checks": [],
        "x-observed-required-input": [],
        "x-observed-errors": [
          "unknown_error"
        ],
        "x-feature-keys": [],
        "x-internal": false
      }
    },
    "/auth/register/send-code": {
      "post": {
        "operationId": "sso_post__auth_register_send_code",
        "tags": [
          "auth/register"
        ],
        "summary": "POST /auth/register/send-code",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained. SSO browser auth: credentialed CORS and shared session/rate-limit state. No browser application keys.",
        "parameters": [
          {
            "name": "Origin",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Must be in configured SSO_CORS_ORIGINS."
          }
        ],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.sso",
          "file": "src/auth/routes.js",
          "line": 187
        },
        "x-source-checks": [
          "OriginAllowed",
          "SharedRateLimit",
          "DelegatedAccountMethod"
        ],
        "x-observed-required-input": [
          "key",
          "m"
        ],
        "x-observed-errors": [
          "incorrect_data",
          "too_many_requests",
          "unknown_error"
        ],
        "x-feature-keys": [],
        "x-internal": false,
        "requestBody": {
          "required": true,
          "description": "Keyless browser router parses JSON only. Authentication uses the HttpOnly cookie; credentials are not query parameters.",
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "key": {
                    "type": [
                      "string",
                      "number"
                    ],
                    "description": "Keyless wrapper accepts a string/number, normalizes it, then validates through the account method."
                  },
                  "m": {
                    "type": [
                      "string",
                      "number"
                    ],
                    "description": "Keyless wrapper accepts a string/number, normalizes it, then validates through the account method."
                  }
                },
                "required": [
                  "key",
                  "m"
                ],
                "additionalProperties": true
              }
            }
          }
        }
      }
    },
    "/auth/register/confirm": {
      "post": {
        "operationId": "sso_post__auth_register_confirm",
        "tags": [
          "auth/register"
        ],
        "summary": "POST /auth/register/confirm",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained. SSO browser auth: credentialed CORS and shared session/rate-limit state. No browser application keys.",
        "parameters": [
          {
            "name": "Origin",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Must be in configured SSO_CORS_ORIGINS."
          }
        ],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.sso",
          "file": "src/auth/routes.js",
          "line": 188
        },
        "x-source-checks": [
          "OriginAllowed",
          "SharedRateLimit",
          "DelegatedAccountMethod"
        ],
        "x-observed-required-input": [
          "key",
          "code"
        ],
        "x-observed-errors": [
          "incorrect_data",
          "too_many_requests",
          "unknown_error"
        ],
        "x-feature-keys": [],
        "x-internal": false,
        "requestBody": {
          "required": true,
          "description": "Keyless browser router parses JSON only. Authentication uses the HttpOnly cookie; credentials are not query parameters.",
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "key": {
                    "type": [
                      "string",
                      "number"
                    ],
                    "description": "Keyless wrapper accepts a string/number, normalizes it, then validates through the account method."
                  },
                  "code": {
                    "type": [
                      "string",
                      "number"
                    ],
                    "description": "Keyless wrapper accepts a string/number, normalizes it, then validates through the account method."
                  }
                },
                "required": [
                  "key",
                  "code"
                ],
                "additionalProperties": true
              }
            }
          }
        }
      }
    },
    "/auth/register": {
      "post": {
        "operationId": "sso_post__auth_register",
        "tags": [
          "auth/register"
        ],
        "summary": "POST /auth/register",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained. SSO browser auth: credentialed CORS and shared session/rate-limit state. No browser application keys.",
        "parameters": [
          {
            "name": "Origin",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Must be in configured SSO_CORS_ORIGINS."
          }
        ],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.sso",
          "file": "src/auth/routes.js",
          "line": 189
        },
        "x-source-checks": [
          "OriginAllowed",
          "SharedRateLimit",
          "DelegatedAccountMethod"
        ],
        "x-observed-required-input": [
          "first_name",
          "last_name",
          "sex",
          "pass",
          "pass2",
          "email",
          "phone",
          "key",
          "code"
        ],
        "x-observed-errors": [
          "incorrect_data",
          "too_many_requests",
          "unknown_error"
        ],
        "x-feature-keys": [],
        "x-internal": false,
        "requestBody": {
          "required": true,
          "description": "Keyless browser router parses JSON only. Authentication uses the HttpOnly cookie; credentials are not query parameters.",
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "first_name": {
                    "type": [
                      "string",
                      "number"
                    ],
                    "description": "Keyless wrapper accepts a string/number, normalizes it, then validates through the account method."
                  },
                  "last_name": {
                    "type": [
                      "string",
                      "number"
                    ],
                    "description": "Keyless wrapper accepts a string/number, normalizes it, then validates through the account method."
                  },
                  "sex": {
                    "type": [
                      "string",
                      "number"
                    ],
                    "description": "Keyless wrapper accepts a string/number, normalizes it, then validates through the account method."
                  },
                  "pass": {
                    "type": [
                      "string",
                      "number"
                    ],
                    "description": "Keyless wrapper accepts a string/number, normalizes it, then validates through the account method."
                  },
                  "pass2": {
                    "type": [
                      "string",
                      "number"
                    ],
                    "description": "Keyless wrapper accepts a string/number, normalizes it, then validates through the account method."
                  },
                  "email": {
                    "type": [
                      "string",
                      "number"
                    ],
                    "description": "Keyless wrapper accepts a string/number, normalizes it, then validates through the account method."
                  },
                  "phone": {
                    "type": [
                      "string",
                      "number"
                    ],
                    "description": "Keyless wrapper accepts a string/number, normalizes it, then validates through the account method."
                  },
                  "key": {
                    "type": [
                      "string",
                      "number"
                    ],
                    "description": "Keyless wrapper accepts a string/number, normalizes it, then validates through the account method."
                  },
                  "code": {
                    "type": [
                      "string",
                      "number"
                    ],
                    "description": "Keyless wrapper accepts a string/number, normalizes it, then validates through the account method."
                  }
                },
                "required": [
                  "first_name",
                  "last_name",
                  "sex",
                  "pass",
                  "pass2",
                  "email",
                  "phone",
                  "key",
                  "code"
                ],
                "additionalProperties": true
              }
            }
          }
        }
      }
    },
    "/auth/restore/send-code": {
      "post": {
        "operationId": "sso_post__auth_restore_send_code",
        "tags": [
          "auth/restore"
        ],
        "summary": "POST /auth/restore/send-code",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained. SSO browser auth: credentialed CORS and shared session/rate-limit state. No browser application keys.",
        "parameters": [
          {
            "name": "Origin",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Must be in configured SSO_CORS_ORIGINS."
          }
        ],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.sso",
          "file": "src/auth/routes.js",
          "line": 190
        },
        "x-source-checks": [
          "OriginAllowed",
          "SharedRateLimit",
          "DelegatedAccountMethod"
        ],
        "x-observed-required-input": [
          "key"
        ],
        "x-observed-errors": [
          "incorrect_data",
          "too_many_requests",
          "unknown_error"
        ],
        "x-feature-keys": [],
        "x-internal": false,
        "requestBody": {
          "required": true,
          "description": "Keyless browser router parses JSON only. Authentication uses the HttpOnly cookie; credentials are not query parameters.",
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "key": {
                    "type": [
                      "string",
                      "number"
                    ],
                    "description": "Keyless wrapper accepts a string/number, normalizes it, then validates through the account method."
                  }
                },
                "required": [
                  "key"
                ],
                "additionalProperties": true
              }
            }
          }
        }
      }
    },
    "/auth/restore/confirm": {
      "post": {
        "operationId": "sso_post__auth_restore_confirm",
        "tags": [
          "auth/restore"
        ],
        "summary": "POST /auth/restore/confirm",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained. SSO browser auth: credentialed CORS and shared session/rate-limit state. No browser application keys.",
        "parameters": [
          {
            "name": "Origin",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Must be in configured SSO_CORS_ORIGINS."
          }
        ],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.sso",
          "file": "src/auth/routes.js",
          "line": 191
        },
        "x-source-checks": [
          "OriginAllowed",
          "SharedRateLimit",
          "DelegatedAccountMethod"
        ],
        "x-observed-required-input": [
          "key",
          "code"
        ],
        "x-observed-errors": [
          "incorrect_data",
          "too_many_requests",
          "unknown_error"
        ],
        "x-feature-keys": [],
        "x-internal": false,
        "requestBody": {
          "required": true,
          "description": "Keyless browser router parses JSON only. Authentication uses the HttpOnly cookie; credentials are not query parameters.",
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "key": {
                    "type": [
                      "string",
                      "number"
                    ],
                    "description": "Keyless wrapper accepts a string/number, normalizes it, then validates through the account method."
                  },
                  "code": {
                    "type": [
                      "string",
                      "number"
                    ],
                    "description": "Keyless wrapper accepts a string/number, normalizes it, then validates through the account method."
                  }
                },
                "required": [
                  "key",
                  "code"
                ],
                "additionalProperties": true
              }
            }
          }
        }
      }
    },
    "/auth/restore/find": {
      "post": {
        "operationId": "sso_post__auth_restore_find",
        "tags": [
          "auth/restore"
        ],
        "summary": "POST /auth/restore/find",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained. SSO browser auth: credentialed CORS and shared session/rate-limit state. No browser application keys.",
        "parameters": [
          {
            "name": "Origin",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Must be in configured SSO_CORS_ORIGINS."
          }
        ],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.sso",
          "file": "src/auth/routes.js",
          "line": 192
        },
        "x-source-checks": [
          "OriginAllowed",
          "SharedRateLimit",
          "DelegatedAccountMethod"
        ],
        "x-observed-required-input": [
          "first_name",
          "last_name",
          "key",
          "code"
        ],
        "x-observed-errors": [
          "incorrect_data",
          "too_many_requests",
          "unknown_error"
        ],
        "x-feature-keys": [],
        "x-internal": false,
        "requestBody": {
          "required": true,
          "description": "Keyless browser router parses JSON only. Authentication uses the HttpOnly cookie; credentials are not query parameters.",
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "first_name": {
                    "type": [
                      "string",
                      "number"
                    ],
                    "description": "Keyless wrapper accepts a string/number, normalizes it, then validates through the account method."
                  },
                  "last_name": {
                    "type": [
                      "string",
                      "number"
                    ],
                    "description": "Keyless wrapper accepts a string/number, normalizes it, then validates through the account method."
                  },
                  "key": {
                    "type": [
                      "string",
                      "number"
                    ],
                    "description": "Keyless wrapper accepts a string/number, normalizes it, then validates through the account method."
                  },
                  "code": {
                    "type": [
                      "string",
                      "number"
                    ],
                    "description": "Keyless wrapper accepts a string/number, normalizes it, then validates through the account method."
                  }
                },
                "required": [
                  "first_name",
                  "last_name",
                  "key",
                  "code"
                ],
                "additionalProperties": true
              }
            }
          }
        }
      }
    },
    "/auth/restore": {
      "post": {
        "operationId": "sso_post__auth_restore",
        "tags": [
          "auth/restore"
        ],
        "summary": "POST /auth/restore",
        "description": "Registered HTTP route; global and route middleware also apply. Response schema is deliberately unconstrained. SSO browser auth: credentialed CORS and shared session/rate-limit state. No browser application keys.",
        "parameters": [
          {
            "name": "Origin",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Must be in configured SSO_CORS_ORIGINS."
          }
        ],
        "responses": {
          "default": {
            "description": "Route-specific response, redirect, binary or error; inspect the named controller."
          }
        },
        "x-source": {
          "repository": "ozl.ozprotect.sso",
          "file": "src/auth/routes.js",
          "line": 193
        },
        "x-source-checks": [
          "OriginAllowed",
          "SharedRateLimit",
          "DelegatedAccountMethod"
        ],
        "x-observed-required-input": [
          "first_name",
          "last_name",
          "pass",
          "pass2",
          "key",
          "code"
        ],
        "x-observed-errors": [
          "incorrect_data",
          "too_many_requests",
          "unknown_error"
        ],
        "x-feature-keys": [],
        "x-internal": false,
        "requestBody": {
          "required": true,
          "description": "Keyless browser router parses JSON only. Authentication uses the HttpOnly cookie; credentials are not query parameters.",
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "first_name": {
                    "type": [
                      "string",
                      "number"
                    ],
                    "description": "Keyless wrapper accepts a string/number, normalizes it, then validates through the account method."
                  },
                  "last_name": {
                    "type": [
                      "string",
                      "number"
                    ],
                    "description": "Keyless wrapper accepts a string/number, normalizes it, then validates through the account method."
                  },
                  "pass": {
                    "type": [
                      "string",
                      "number"
                    ],
                    "description": "Keyless wrapper accepts a string/number, normalizes it, then validates through the account method."
                  },
                  "pass2": {
                    "type": [
                      "string",
                      "number"
                    ],
                    "description": "Keyless wrapper accepts a string/number, normalizes it, then validates through the account method."
                  },
                  "key": {
                    "type": [
                      "string",
                      "number"
                    ],
                    "description": "Keyless wrapper accepts a string/number, normalizes it, then validates through the account method."
                  },
                  "code": {
                    "type": [
                      "string",
                      "number"
                    ],
                    "description": "Keyless wrapper accepts a string/number, normalizes it, then validates through the account method."
                  }
                },
                "required": [
                  "first_name",
                  "last_name",
                  "pass",
                  "pass2",
                  "key",
                  "code"
                ],
                "additionalProperties": true
              }
            }
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "Success": {
        "type": "object",
        "required": [
          "status",
          "response"
        ],
        "properties": {
          "status": {
            "const": "success"
          },
          "response": {},
          "info": {
            "type": "object",
            "additionalProperties": true
          }
        },
        "additionalProperties": true
      },
      "Error": {
        "type": "object",
        "required": [
          "status",
          "error_name",
          "error_msg"
        ],
        "properties": {
          "status": {
            "const": "error"
          },
          "error_name": {
            "type": "string"
          },
          "error_msg": {
            "type": "string"
          }
        },
        "additionalProperties": true
      }
    },
    "securitySchemes": {
      "AccessToken": {
        "type": "apiKey",
        "in": "query",
        "name": "access_token",
        "description": "Legacy access_token request field. POST may carry it in the body instead; this is not an HTTP Bearer token."
      },
      "Bearer": {
        "type": "http",
        "scheme": "bearer",
        "bearerFormat": "JWT",
        "description": "Only routes explicitly using JWT authentication."
      },
      "SsoCookie": {
        "type": "apiKey",
        "in": "cookie",
        "name": "__Host-ozsso",
        "description": "HttpOnly host-only cookie; explicit HTTP loopback development uses ozsso instead."
      }
    }
  },
  "x-source-snapshot": {
    "repository": "ozl.ozprotect.sso",
    "commit": "06834b99928df86eb5b1cd96bae8c23e8e695eb8",
    "ref": "origin/claude/dev-work",
    "dirty": false
  }
}