Auth

Headers on every response

Every response on this page carries these headers.

X-Trace-Id: — The W3C trace id of this request — the same id in the log and in the traceId of a problem. Quote it when reporting.
Server-Timing: — Where the time went: total, db;dur=…;desc="N queries", and every step the handler named (ADR-163).
X-Diagnostics: — Only when the request asked with X-Diagnostics: 1 or ?diagnostics=1: the same breakdown as one JSON object, with the trace id (ADR-163).

Operations

GET/api/v1/me

Get the signed-in account and every household it belongs to

Also says whether the e-mail is confirmed, whether the account has a password, and whether the caller is a platform admin. 401 when the cookie belongs to an account that no longer exists (#978).

Parameters

No parameters

Responses

200OK

application/jsonMeResponse

401No session, or the session is no longer valid.

application/problem+jsonProblemDetails

426The build named in X-App-Version is below its platform's version floor (ADR-070). Problem type app-version-unsupported; the only way forward is the store. Callers without the header are never turned away.

application/problem+jsonProblemDetails

429Too many calls in the window; Retry-After says how long.

application/problem+jsonProblemDetails

Headers

Retry-After: — Seconds to wait when a rate limit answered, or an HTTP date when the household's AI is paused. Absent when the household's AI quota for the period is used up — that resets by itself.

Example

curl -b "bryti_session=…" \
  "https://bryti.app/api/v1/me"

Example response

200application/json

{
  "user": {
    "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "email": "string",
    "displayName": "string"
  },
  "memberships": [
    {
      "householdId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "householdName": "string",
      "role": {},
      "memberId": "3fa85f64-5717-4562-b3fc-2c963f66afa6"
    }
  ],
  "isPlatformAdmin": false,
  "emailConfirmed": true,
  "hasPassword": true
}

PATCH/api/v1/me

Rename the signed-in account

Only the display name changes here (1–80 characters, else 400); e-mail and password have their own confirmed paths (#298). Answers the updated account.

Parameters

No parameters

Request body

application/jsonRequiredUpdateMeRequest

Responses

200OK

application/jsonMeResponse

400Bad Request

application/problem+jsonProblemDetails

401No session, or the session is no longer valid.

application/problem+jsonProblemDetails

429Too many calls in the window; Retry-After says how long.

application/problem+jsonProblemDetails

Headers

Retry-After: — Seconds to wait when a rate limit answered, or an HTTP date when the household's AI is paused. Absent when the household's AI quota for the period is used up — that resets by itself.

Problem codes

The `code` in the problem body is what to branch on. `detail` is English, written for a log.

account_name_length: — Give the account a name, of up to 80 characters.

Example

curl -b "bryti_session=…" \
  -X PATCH \
  "https://bryti.app/api/v1/me" \
  -H "Content-Type: application/json" \
  -d '{"displayName":"string"}'

Example response

200application/json

{
  "user": {
    "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "email": "string",
    "displayName": "string"
  },
  "memberships": [
    {
      "householdId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "householdName": "string",
      "role": {},
      "memberId": "3fa85f64-5717-4562-b3fc-2c963f66afa6"
    }
  ],
  "isPlatformAdmin": false,
  "emailConfirmed": true,
  "hasPassword": true
}

POST/api/v1/me/password

Change the account's password, or set a first one on a social-only account

The current password is required when the account has one: 400 with code wrong_current_password when it is wrong, plain 400 with the rules when the new one is too weak, and code password_pwned when it has been seen in a breach (ADR-290). This session stays signed in; every other session is asked to sign in again (#978).

Parameters

No parameters

Request body

application/jsonRequiredChangePasswordRequest

Responses

204No Content

400Bad Request

application/problem+jsonProblemDetails

401No session, or the session is no longer valid.

application/problem+jsonProblemDetails

429Too many calls in the window; Retry-After says how long.

application/problem+jsonProblemDetails

Headers

Retry-After: — Seconds to wait when a rate limit answered, or an HTTP date when the household's AI is paused. Absent when the household's AI quota for the period is used up — that resets by itself.

Problem codes

The `code` in the problem body is what to branch on. `detail` is English, written for a log.

password_pwned: — That password has been seen in a breach. Choose another.
password_rejected: — That password can't be used. Pick a longer one, at least 8 characters.
wrong_current_password: — The current password didn't match.

Example

curl -b "bryti_session=…" \
  -X POST \
  "https://bryti.app/api/v1/me/password" \
  -H "Content-Type: application/json" \
  -d '{"currentPassword":"string","newPassword":"string"}'

POST/api/v1/me/email

Ask to move the login to a new e-mail address

Nothing changes until the link mailed to the new address is followed (POST /api/v1/auth/confirm-email-change); the old address gets a heads-up with a reset link (#1826). Always 204 for a well-formed address — never says whether it is taken. 400 when it does not look like an e-mail address.

Parameters

No parameters

Request body

application/jsonRequiredChangeEmailRequest

Responses

204No Content

400Bad Request

application/problem+jsonProblemDetails

401No session, or the session is no longer valid.

application/problem+jsonProblemDetails

429Too many calls in the window; Retry-After says how long.

application/problem+jsonProblemDetails

Headers

Retry-After: — Seconds to wait when a rate limit answered, or an HTTP date when the household's AI is paused. Absent when the household's AI quota for the period is used up — that resets by itself.

Problem codes

The `code` in the problem body is what to branch on. `detail` is English, written for a log.

email_not_an_address: — That doesn't look like an email address.

Example

curl -b "bryti_session=…" \
  -X POST \
  "https://bryti.app/api/v1/me/email" \
  -H "Content-Type: application/json" \
  -d '{"newEmail":"string"}'

POST/api/v1/auth/registerNo session needed

Create a password account and sign the caller in

Public. Answers 200 whether or not the address already has an account (#985): a fresh sign-up gets a confirmation mail and a session cookie, a known address gets a "you already have an account" mail and no session. Confirmation never gates the app; an address on the waitlist becomes this account's row (ADR-147). 400 carries the password or format errors, with code password_pwned when the password is one Have I Been Pwned has seen in a breach (ADR-290). Rate-limited per client IP with the rest of /api/v1/auth (#1078): over the ceiling answers 429 with a Retry-After header.

Parameters

No parameters

Request body

application/jsonRequiredRegisterRequest

Responses

200OK

400Bad Request

application/problem+jsonProblemDetails

429Too many calls in the window; Retry-After says how long.

application/problem+jsonProblemDetails

Headers

Retry-After: — Seconds to wait when a rate limit answered, or an HTTP date when the household's AI is paused. Absent when the household's AI quota for the period is used up — that resets by itself.

Problem codes

The `code` in the problem body is what to branch on. `detail` is English, written for a log.

password_pwned: — That password has been seen in a breach. Choose another.
signup_rejected: — That couldn't be used to sign up. Check the email address, and pick a password of at least 8 characters.

Example

curl \
  -X POST \
  "https://bryti.app/api/v1/auth/register" \
  -H "Content-Type: application/json" \
  -d '{"email":"string","password":"string","displayName":"string"}'

POST/api/v1/auth/loginNo session needed

Sign in with e-mail and password and get the account with its households

Public. Sets the session cookie and answers the same body as GET /api/v1/me. 401 for a wrong e-mail or password (never says which). 423 with code account_locked when the account is locked for a few minutes after too many wrong passwords (#986) — wait, or use forgot-password. Rate-limited per client IP with the rest of /api/v1/auth (#1078): over the ceiling answers 429 with a Retry-After header.

Parameters

No parameters

Request body

application/jsonRequiredLoginRequest

Responses

200OK

application/jsonMeResponse

400The request could not be read as the route needs it: a body that is not the documented shape (a required field left out, a null where none is allowed, a value too long for its field), a parameter that does not parse, or a NUL character anywhere (#3540, #3541, #3543). Code validation_failed or value_too_long.

application/problem+jsonProblemDetails

401Unauthorized

application/problem+jsonProblemDetails

423Locked

application/problem+jsonProblemDetails

429Too many calls in the window; Retry-After says how long.

application/problem+jsonProblemDetails

Headers

Retry-After: — Seconds to wait when a rate limit answered, or an HTTP date when the household's AI is paused. Absent when the household's AI quota for the period is used up — that resets by itself.

Problem codes

The `code` in the problem body is what to branch on. `detail` is English, written for a log.

account_locked: — There were too many attempts, so the account is locked for a few minutes. Try again shortly, or use “Forgot password?”.
invalid_credentials: — Wrong email or password.

Example

curl \
  -X POST \
  "https://bryti.app/api/v1/auth/login" \
  -H "Content-Type: application/json" \
  -d '{"email":"string","password":"string"}'

Example response

200application/json

{
  "user": {
    "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "email": "string",
    "displayName": "string"
  },
  "memberships": [
    {
      "householdId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "householdName": "string",
      "role": {},
      "memberId": "3fa85f64-5717-4562-b3fc-2c963f66afa6"
    }
  ],
  "isPlatformAdmin": false,
  "emailConfirmed": true,
  "hasPassword": true
}

POST/api/v1/auth/logout

Sign out and revoke every other copy of this session

Signed-in callers only. Rotates the security stamp, so a duplicated or stolen cookie fails its next check as well (#978). Rate-limited per client IP with the rest of /api/v1/auth (#1078): over the ceiling answers 429 with a Retry-After header.

Parameters

No parameters

Responses

204No Content

401No session, or the session is no longer valid.

application/problem+jsonProblemDetails

429Too many calls in the window; Retry-After says how long.

application/problem+jsonProblemDetails

Headers

Retry-After: — Seconds to wait when a rate limit answered, or an HTTP date when the household's AI is paused. Absent when the household's AI quota for the period is used up — that resets by itself.

Example

curl -b "bryti_session=…" \
  -X POST \
  "https://bryti.app/api/v1/auth/logout"

POST/api/v1/auth/confirm-emailNo session needed

Confirm the account's e-mail address with the token from the mailed link

Public: followed from a mail client, so the token in the body is the proof (#603). Safe to retry: an already confirmed address answers 204 again. 400 with code invalid_token when the link expired or was already used. Rate-limited per client IP with the rest of /api/v1/auth (#1078): over the ceiling answers 429 with a Retry-After header.

Parameters

No parameters

Request body

application/jsonRequiredConfirmEmailRequest

Responses

204No Content

400Bad Request

application/problem+jsonProblemDetails

429Too many calls in the window; Retry-After says how long.

application/problem+jsonProblemDetails

Headers

Retry-After: — Seconds to wait when a rate limit answered, or an HTTP date when the household's AI is paused. Absent when the household's AI quota for the period is used up — that resets by itself.

Problem codes

The `code` in the problem body is what to branch on. `detail` is English, written for a log.

invalid_token: — This link has expired or was already used. Ask for a new one.

Example

curl \
  -X POST \
  "https://bryti.app/api/v1/auth/confirm-email" \
  -H "Content-Type: application/json" \
  -d '{"userId":"3fa85f64-5717-4562-b3fc-2c963f66afa6","token":"string"}'

POST/api/v1/auth/confirm-email-changeNo session needed

Move the login to the new e-mail address with the token from the mailed link

Public: the token, bound to the new address, is the proof (#603). Marks the new address confirmed and revokes every other session (#978); a browser that follows the link while signed in as this account keeps its own. 400 with code invalid_token when the link expired, was used, or the address is taken. Rate-limited per client IP with the rest of /api/v1/auth (#1078): over the ceiling answers 429 with a Retry-After header.

Parameters

No parameters

Request body

application/jsonRequiredConfirmEmailChangeRequest

Responses

204No Content

400Bad Request

application/problem+jsonProblemDetails

429Too many calls in the window; Retry-After says how long.

application/problem+jsonProblemDetails

Headers

Retry-After: — Seconds to wait when a rate limit answered, or an HTTP date when the household's AI is paused. Absent when the household's AI quota for the period is used up — that resets by itself.

Problem codes

The `code` in the problem body is what to branch on. `detail` is English, written for a log.

invalid_token: — This link has expired or was already used. Ask for a new one.

Example

curl \
  -X POST \
  "https://bryti.app/api/v1/auth/confirm-email-change" \
  -H "Content-Type: application/json" \
  -d '{"userId":"3fa85f64-5717-4562-b3fc-2c963f66afa6","newEmail":"string","token":"string"}'

POST/api/v1/auth/resend-confirmation

Send the e-mail confirmation mail again

Signed-in callers only. Answers 204 without mailing when the address is already confirmed. 429 with code resend_cooldown when a confirmation mail went out less than five minutes ago. Also rate-limited per client IP with the rest of /api/v1/auth (#1078): over that ceiling answers 429 with a Retry-After header.

Parameters

No parameters

Responses

204No Content

401No session, or the session is no longer valid.

application/problem+jsonProblemDetails

429Too Many Requests

application/problem+jsonProblemDetails

Headers

Retry-After: — Seconds to wait when a rate limit answered, or an HTTP date when the household's AI is paused. Absent when the household's AI quota for the period is used up — that resets by itself.

Problem codes

The `code` in the problem body is what to branch on. `detail` is English, written for a log.

resend_cooldown: — The last email just went out. Wait a moment before asking for another.

Example

curl -b "bryti_session=…" \
  -X POST \
  "https://bryti.app/api/v1/auth/resend-confirmation"

POST/api/v1/auth/forgot-passwordNo session needed

Mail a password-reset link to the address, if it has an account

Public. Always 204 — never says whether the address exists, and a second request for the same account within five minutes is silently dropped (#1055). Rate-limited per client IP with the rest of /api/v1/auth (#1078): over the ceiling answers 429 with a Retry-After header.

Parameters

No parameters

Request body

application/jsonRequiredForgotPasswordRequest

Responses

204No Content

application/problem+jsonProblemDetails

429Too many calls in the window; Retry-After says how long.

application/problem+jsonProblemDetails

Headers

Retry-After: — Seconds to wait when a rate limit answered, or an HTTP date when the household's AI is paused. Absent when the household's AI quota for the period is used up — that resets by itself.

Example

curl \
  -X POST \
  "https://bryti.app/api/v1/auth/forgot-password" \
  -H "Content-Type: application/json" \
  -d '{"email":"string"}'

POST/api/v1/auth/reset-passwordNo session needed

Set a new password with the token from the reset mail

Public: the reset token is the proof (#603). A reset also marks the address confirmed. 400 with code invalid_token when the link expired or was used; plain 400 with the password rules when the new password is too weak, or code password_pwned when it has been seen in a breach (ADR-290). Rate-limited per client IP with the rest of /api/v1/auth (#1078): over the ceiling answers 429 with a Retry-After header.

Parameters

No parameters

Request body

application/jsonRequiredResetPasswordRequest

Responses

204No Content

400Bad Request

application/problem+jsonProblemDetails

429Too many calls in the window; Retry-After says how long.

application/problem+jsonProblemDetails

Headers

Retry-After: — Seconds to wait when a rate limit answered, or an HTTP date when the household's AI is paused. Absent when the household's AI quota for the period is used up — that resets by itself.

Problem codes

The `code` in the problem body is what to branch on. `detail` is English, written for a log.

invalid_token: — This link has expired or was already used. Ask for a new one.
password_pwned: — That password has been seen in a breach. Choose another.
password_rejected: — That password can't be used. Pick a longer one, at least 8 characters.

Example

curl \
  -X POST \
  "https://bryti.app/api/v1/auth/reset-password" \
  -H "Content-Type: application/json" \
  -d '{"email":"string","token":"string","newPassword":"string"}'

GET/api/v1/auth/providersNo session needed

List the social login providers this server is configured for

Public: the sign-in screen asks which buttons to draw before anyone is signed in (#603). Rate-limited per client IP with the rest of /api/v1/auth (#1078): over the ceiling answers 429 with a Retry-After header.

Parameters

No parameters

Responses

200OK

application/jsonAuthProviderResponse[]

application/problem+jsonProblemDetails

429Too many calls in the window; Retry-After says how long.

application/problem+jsonProblemDetails

Headers

Retry-After: — Seconds to wait when a rate limit answered, or an HTTP date when the household's AI is paused. Absent when the household's AI quota for the period is used up — that resets by itself.

Example

curl \
  "https://bryti.app/api/v1/auth/providers"

Example response

200application/json

[
  {
    "scheme": "string",
    "displayName": "string"
  }
]

GET/api/v1/auth/challenge/{provider}No session needed

Start a social login by redirecting to the provider

Public. Browser flow: returnUrl (a site-relative path) is where the callback lands afterwards. App flow (#79): send codeChallenge and an allow-listed redirectUri, and the callback ends on the app's own URI with a single-use code for POST /api/v1/auth/exchange; 400 when only one of the two is given or the URI is not allowed. 404 for an unknown provider. Answers a 302 redirect to the provider, not JSON. Rate-limited per client IP with the rest of /api/v1/auth (#1078): over the ceiling answers 429 with a Retry-After header.

Parameters

Name	In	Type	Required	Description
`provider`	path	`string`	Required	—
`returnUrl`	query	`string`	—	—
`redirectUri`	query	`string`	—	—
`codeChallenge`	query	`string`	—	—

Responses

400Bad Request

application/problem+jsonProblemDetails

404Not Found

application/problem+jsonProblemDetails

429Too many calls in the window; Retry-After says how long.

application/problem+jsonProblemDetails

Headers

Retry-After: — Seconds to wait when a rate limit answered, or an HTTP date when the household's AI is paused. Absent when the household's AI quota for the period is used up — that resets by itself.

Problem codes

The `code` in the problem body is what to branch on. `detail` is English, written for a log.

app_signin_incomplete
unknown_login_provider: — That way of signing in isn't available here.

Example

curl \
  "https://bryti.app/api/v1/auth/challenge/string"

GET/api/v1/auth/external-callbackNo session needed

Finish a social login the provider redirected back to

Public: reads the provider's external cookie and signs in the account behind that identity (#603) — the one already linked, else the one with the same e-mail, else a new one. Browser flow redirects to returnUrl (or to /login when nothing usable came back); app flow (#79) redirects to the app's URI with ?code=… or ?error=account. Answers a 302 redirect, never JSON. Rate-limited per client IP with the rest of /api/v1/auth (#1078): over the ceiling answers 429 with a Retry-After header.

Parameters

Name	In	Type	Required	Description
`returnUrl`	query	`string`	—	—

Responses

application/problem+jsonProblemDetails

401Unauthorized

application/problem+jsonProblemDetails

429Too many calls in the window; Retry-After says how long.

application/problem+jsonProblemDetails

Headers

Retry-After: — Seconds to wait when a rate limit answered, or an HTTP date when the household's AI is paused. Absent when the household's AI quota for the period is used up — that resets by itself.

Example

curl \
  "https://bryti.app/api/v1/auth/external-callback"

POST/api/v1/auth/exchangeNo session needed

Trade the app's single-use sign-in code for a session

Public: the PKCE verifier is the proof (#79, #603). The code lives two minutes and works once; 401 when it expired, was used, or the verifier does not match — start the sign-in again. Answers the same body as GET /api/v1/me. Rate-limited per client IP with the rest of /api/v1/auth (#1078): over the ceiling answers 429 with a Retry-After header.

Parameters

No parameters

Request body

application/jsonRequiredExchangeAuthCodeRequest

Responses

200OK

application/jsonMeResponse

application/problem+jsonProblemDetails

401Unauthorized

application/problem+jsonProblemDetails

429Too many calls in the window; Retry-After says how long.

application/problem+jsonProblemDetails

Headers

Retry-After: — Seconds to wait when a rate limit answered, or an HTTP date when the household's AI is paused. Absent when the household's AI quota for the period is used up — that resets by itself.

Problem codes

The `code` in the problem body is what to branch on. `detail` is English, written for a log.

signin_code_spent: — That sign-in took too long or was already used. Start it again.

Example

curl \
  -X POST \
  "https://bryti.app/api/v1/auth/exchange" \
  -H "Content-Type: application/json" \
  -d '{"code":"string","codeVerifier":"string"}'

Example response

200application/json

{
  "user": {
    "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "email": "string",
    "displayName": "string"
  },
  "memberships": [
    {
      "householdId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "householdName": "string",
      "role": {},
      "memberId": "3fa85f64-5717-4562-b3fc-2c963f66afa6"
    }
  ],
  "isPlatformAdmin": false,
  "emailConfirmed": true,
  "hasPassword": true
}

POST/api/v1/auth/apple/nativeNo session needed

Sign in with the identity token from the native Sign in with Apple sheet

Public: the token is checked against Apple's keys (#288, #603) and signs in the same account the web flow would — linked by Apple's stable sub, else by e-mail, else a new account. 401 when Apple does not vouch for the token. 404 when native Sign in with Apple is not configured on this server. Rate-limited per client IP with the rest of /api/v1/auth (#1078): over the ceiling answers 429 with a Retry-After header.

Parameters

No parameters

Request body

application/jsonRequiredAppleNativeSignInRequest

Responses

200OK

application/jsonMeResponse

application/problem+jsonProblemDetails

401Unauthorized

application/problem+jsonProblemDetails

404Not Found

application/problem+jsonProblemDetails

429Too many calls in the window; Retry-After says how long.

application/problem+jsonProblemDetails

Headers

Retry-After: — Seconds to wait when a rate limit answered, or an HTTP date when the household's AI is paused. Absent when the household's AI quota for the period is used up — that resets by itself.

Problem codes

The `code` in the problem body is what to branch on. `detail` is English, written for a log.

account_not_created: — The account couldn't be created. Try again in a moment.
apple_signin_rejected: — Apple didn't confirm that sign-in. Try again.
apple_signin_unavailable: — Sign in with Apple isn't available here. Use email and password.

Example

curl \
  -X POST \
  "https://bryti.app/api/v1/auth/apple/native" \
  -H "Content-Type: application/json" \
  -d '{"identityToken":"string"}'

Example response

200application/json

{
  "user": {
    "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "email": "string",
    "displayName": "string"
  },
  "memberships": [
    {
      "householdId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "householdName": "string",
      "role": {},
      "memberId": "3fa85f64-5717-4562-b3fc-2c963f66afa6"
    }
  ],
  "isPlatformAdmin": false,
  "emailConfirmed": true,
  "hasPassword": true
}

Schemas

AppleNativeSignInRequest

Property	Type	Required
`identityToken`	`string`	Required
`rawNonce`	`string \| null`	—
`givenName`	`string \| null`	—
`familyName`	`string \| null`	—
`email`	`string \| null`	—

AuthProviderResponse

Property	Type	Required
`scheme`	`string`	Required
`displayName`	`string`	Required

ChangeEmailRequest

Property	Type	Required
`newEmail`	`string`	Required

ChangePasswordRequest

Property	Type	Required
`currentPassword`	`string \| null`	Required
`newPassword`	`string`	Required

ConfirmEmailChangeRequest

Property	Type	Required
`userId`	`string (uuid)`	Required
`newEmail`	`string`	Required
`token`	`string`	Required

ConfirmEmailRequest

Property	Type	Required
`userId`	`string (uuid)`	Required
`token`	`string`	Required

ExchangeAuthCodeRequest

Property	Type	Required
`code`	`string`	Required
`codeVerifier`	`string`	Required

ForgotPasswordRequest

Property	Type	Required
`email`	`string`	Required

HouseholdRole

Type

Values

OwnerAdultJunior

LoginRequest

Property	Type	Required
`email`	`string`	Required
`password`	`string`	Required

MembershipResponse

Property	Type	Required
`householdId`	`string (uuid)`	Required
`householdName`	`string`	Required
`role`	`HouseholdRole`	Required
`memberId`	`string (uuid) \| null`	Required

MeResponse

Property	Type	Required
`user`	`UserResponse`	Required
`memberships`	`MembershipResponse[]`	Required
`isPlatformAdmin`	`boolean`	Required
`emailConfirmed`	`boolean`	—
`hasPassword`	`boolean`	—
`serverNow`	`string \| null`	—

ProblemDetails

Property	Type	Required
`type`	`string \| null`	—
`title`	`string \| null`	—
`status`	`integer (int32) \| null`	—
`detail`	`string \| null`	—
`instance`	`string \| null`	—
`code`	`string \| null`	—

RegisterRequest

Property	Type	Required
`email`	`string`	Required
`password`	`string`	Required
`displayName`	`string`	Required

ResetPasswordRequest

Property	Type	Required
`email`	`string`	Required
`token`	`string`	Required
`newPassword`	`string`	Required

UpdateMeRequest

Property	Type	Required
`displayName`	`string`	Required

UserResponse

Property	Type	Required
`id`	`string (uuid)`	Required
`email`	`string \| null`	Required
`displayName`	`string`	Required