api.user.m7.org Docs

This folder documents the current api.user.m7.org route surface at:

https://api.user.m7.org/api/v2

The docs are now split by support boundary.

Start Here

Public vs Private

Public

Public docs are for routes that are part of the supported direct API contract on api.user.m7.org.

Important nuance:

  • public does not mean anonymous
  • many public routes still require an authenticated user, owner, or app context
  • public here means a caller can integrate against the route directly without depending on a hidden first-party bridge contract

Private

Private docs are for routes that are live on the host, but are not meant to be used as direct integration surfaces.

These are usually:

  • first-party SSO bridge endpoints
  • relay-backed token-mint or token-exchange helpers
  • retained legacy handlers that stay on disk for reference

Current Family Split

Public direct families

  • /session/me
  • /account/*
  • /org/*
  • /org/group/*
  • /org/client/*
  • /oauth/clients/*
  • /oauth/device/*
  • /oauth/client_credentials/issue/web
  • /oauth/client_credentials/revoke
  • /oauth/client_credentials/search/app
  • /oauth/client_credentials/view

Private bridge or backing families

  • /auth/user/*
  • /auth/member/*
  • /auth/signup
  • /oauth/client_credentials/issue
  • retained legacy auth handlers that are no longer mounted

Notes

  • sso.user.m7.org public OAuth and OIDC docs live separately in ../user.m7.org/markdown_docs/.
  • the private auth bridge family is internet-reachable, but it is not a public API contract
  • the current routing state in this doc set reflects the auth, member-auth, account, and org cleanup work as of June 15, 2026
1