Sign-in and sessions

Access: no sign-in required; additional requirements are listed for the method

Rate limit: 5 requests per 60 seconds per address.

JSON / form fields

{
  "email": "PLACEHOLDER_EMAIL (string)",
  "turnstile_token": "PLACEHOLDER_TURNSTILE_TOKEN (string)"
}

PLACEHOLDER represents your input and its type. Replace the values and keep only the optional fields you need. Do not send string placeholders in place of numbers, booleans, objects, or arrays.

Request schema: ForgotPasswordRequest

Response

The JSON response contains code, message, and data. The data contents are described in the schemas below.

Response data schemas: ForgotPasswordResponse. See the Data schemas pages for fields and types.

{
  "code": 0,
  "message": "success",
  "data": {
    "message": "PLACEHOLDER_MESSAGE (string)"
  }
}

Note: this operation changes state or continues a one-time authentication flow. The example describes the contract and is not executed.

Access: no sign-in required; additional requirements are listed for the method

Feature availability and additional access requirements are checked when the request is processed.

Rate limit: 20 requests per 60 seconds per address.

JSON / form fields

{
  "email": "PLACEHOLDER_EMAIL (string)",
  "password": "PLACEHOLDER_PASSWORD (string)",
  "turnstile_token": "PLACEHOLDER_TURNSTILE_TOKEN (string)"
}

PLACEHOLDER represents your input and its type. Replace the values and keep only the optional fields you need. Do not send string placeholders in place of numbers, booleans, objects, or arrays.

Request schema: LoginRequest

Response

The JSON response contains code, message, and data. The data contents are described in the schemas below.

Response data schemas: TotpLoginResponse, User, AuthResponse. See the Data schemas pages for fields and types.

Where several response variants are possible, their fields are listed in separate schemas; do not combine them into one object.

Note: this operation changes state or continues a one-time authentication flow. The example describes the contract and is not executed.

Access: no sign-in required; additional requirements are listed for the method

Feature availability and additional access requirements are checked when the request is processed.

Rate limit: 20 requests per 60 seconds per address.

JSON / form fields

{
  "temp_token": "PLACEHOLDER_TEMP_TOKEN (string)",
  "totp_code": "PLACEHOLDER_TOTP_CODE (string)"
}

PLACEHOLDER represents your input and its type. Replace the values and keep only the optional fields you need. Do not send string placeholders in place of numbers, booleans, objects, or arrays.

Request schema: Login2FARequest

Response

The JSON response contains code, message, and data. The data contents are described in the schemas below.

Response data schemas: User, AuthResponse. See the Data schemas pages for fields and types.

Where several response variants are possible, their fields are listed in separate schemas; do not combine them into one object.

Note: this operation changes state or continues a one-time authentication flow. The example describes the contract and is not executed.

Access: no sign-in required; additional requirements are listed for the method

JSON / form fields

{
  "refresh_token": "PLACEHOLDER_REFRESH_TOKEN (string)"
}

PLACEHOLDER represents your input and its type. Replace the values and keep only the optional fields you need. Do not send string placeholders in place of numbers, booleans, objects, or arrays.

Request schema: LogoutRequest

Response

The JSON response contains code, message, and data. The data contents are described in the schemas below.

Response data schemas: LogoutResponse. See the Data schemas pages for fields and types.

{
  "code": 0,
  "message": "success",
  "data": {
    "message": "PLACEHOLDER_MESSAGE (string)"
  }
}

Note: this operation changes state or continues a one-time authentication flow. The example describes the contract and is not executed.

Access: Dashboard token

curl --fail-with-body "https://ailoot.ai/api/v1/auth/me" \
  -H "Authorization: Bearer $TOKEN"

No request body is required. Send the parameters listed above in the URL.

Response

The JSON response contains code, message, and data. The data contents are described in the schemas below.

Response data schemas: User, UserProfileResponse. See the Data schemas pages for fields and types.

{
  "code": 0,
  "message": "success",
  "data": {
    "id": "PLACEHOLDER_ID (integer)",
    "email": "PLACEHOLDER_EMAIL (string)",
    "username": "PLACEHOLDER_USERNAME (string)",
    "role": "PLACEHOLDER_ROLE (string)",
    "balance": "PLACEHOLDER_BALANCE (number)",
    "frozen_balance": "PLACEHOLDER_FROZEN_BALANCE (number)",
    "concurrency": "PLACEHOLDER_CONCURRENCY (integer)",
    "status": "PLACEHOLDER_STATUS (string)",
    "last_active_at": "PLACEHOLDER_LAST_ACTIVE_AT (string)",
    "created_at": "PLACEHOLDER_CREATED_AT (string)",
    "updated_at": "PLACEHOLDER_UPDATED_AT (string)",
    "deleted_at": "PLACEHOLDER_DELETED_AT (string)",
    "balance_notify_enabled": "PLACEHOLDER_BALANCE_NOTIFY_ENABLED (boolean)",
    "balance_notify_threshold_type": "PLACEHOLDER_BALANCE_NOTIFY_THRESHOLD_TYPE (string)",
    "balance_notify_threshold": "PLACEHOLDER_BALANCE_NOTIFY_THRESHOLD (number)",
    "balance_notify_extra_emails": "PLACEHOLDER_BALANCE_NOTIFY_EXTRA_EMAILS (array)",
    "total_recharged": "PLACEHOLDER_TOTAL_RECHARGED (number)",
    "rpm_limit": "PLACEHOLDER_RPM_LIMIT (integer)",
    "api_keys": "PLACEHOLDER_API_KEYS (array)",
    "avatar_url": "PLACEHOLDER_AVATAR_URL (string)",
    "email_bound": "PLACEHOLDER_EMAIL_BOUND (boolean)"
  }
}

Note: all personal data and objects are scoped to the JWT subject.

Note: key spending limits (quota, quota_used) are returned in key responses, not in the profile. frozen_balance is the reserved amount; do not treat it as available balance.

Access: no sign-in required; additional requirements are listed for the method

Feature availability and additional access requirements are checked when the request is processed.

Rate limit: 20 requests per 60 seconds per address.

JSON / form fields

{
  "turnstile_token": "PLACEHOLDER_TURNSTILE_TOKEN (string)"
}

PLACEHOLDER represents your input and its type. Replace the values and keep only the optional fields you need. Do not send string placeholders in place of numbers, booleans, objects, or arrays.

Request schema: PasskeyBeginLoginRequest

Response

The JSON response contains code, message, and data. The data contents are described in the schemas below.

Response data schemas: PasskeyOptionsResponse. See the Data schemas pages for fields and types.

{
  "code": 0,
  "message": "success",
  "data": {
    "session_token": "PLACEHOLDER_SESSION_TOKEN (string)",
    "options": "PLACEHOLDER_OPTIONS (any)"
  }
}

Note: this operation changes state or continues a one-time authentication flow. The example describes the contract and is not executed.

Note: credential comes from navigator.credentials; session_token comes from begin. The finish body must be <=65536 bytes. Registration and deletion require a password.

Access: no sign-in required; additional requirements are listed for the method

Feature availability and additional access requirements are checked when the request is processed.

Rate limit: 20 requests per 60 seconds per address.

JSON / form fields

{
  "session_token": "PLACEHOLDER_SESSION_TOKEN (string)",
  "name": "PLACEHOLDER_NAME (string)",
  "credential": "PLACEHOLDER_CREDENTIAL (object)"
}

PLACEHOLDER represents your input and its type. Replace the values and keep only the optional fields you need. Do not send string placeholders in place of numbers, booleans, objects, or arrays.

Request schema: PasskeyFinishRequest

Response

The JSON response contains code, message, and data. The data contents are described in the schemas below.

Response data schemas: User, AuthResponse. See the Data schemas pages for fields and types.

Where several response variants are possible, their fields are listed in separate schemas; do not combine them into one object.

Note: this operation changes state or continues a one-time authentication flow. The example describes the contract and is not executed.

Note: credential comes from navigator.credentials; session_token comes from begin. The finish body must be <=65536 bytes. Registration and deletion require a password.

Access: no sign-in required; additional requirements are listed for the method

Feature availability and additional access requirements are checked when the request is processed.

Rate limit: 30 requests per 60 seconds per address.

JSON / form fields

{
  "refresh_token": "PLACEHOLDER_REFRESH_TOKEN (string)"
}

PLACEHOLDER represents your input and its type. Replace the values and keep only the optional fields you need. Do not send string placeholders in place of numbers, booleans, objects, or arrays.

Request schema: RefreshTokenRequest

Response

The JSON response contains code, message, and data. The data contents are described in the schemas below.

Response data schemas: RefreshTokenResponse. See the Data schemas pages for fields and types.

{
  "code": 0,
  "message": "success",
  "data": {
    "access_token": "PLACEHOLDER_ACCESS_TOKEN (string)",
    "refresh_token": "PLACEHOLDER_REFRESH_TOKEN (string)",
    "expires_in": "PLACEHOLDER_EXPIRES_IN (integer)",
    "token_type": "PLACEHOLDER_TOKEN_TYPE (string)"
  }
}

Note: this operation changes state or continues a one-time authentication flow. The example describes the contract and is not executed.

Access: no sign-in required; additional requirements are listed for the method

Rate limit: 5 requests per 60 seconds per address.

JSON / form fields

{
  "email": "PLACEHOLDER_EMAIL (string)",
  "password": "PLACEHOLDER_PASSWORD (string)",
  "verify_code": "PLACEHOLDER_VERIFY_CODE (string)",
  "turnstile_token": "PLACEHOLDER_TURNSTILE_TOKEN (string)",
  "promo_code": "PLACEHOLDER_PROMO_CODE (string)",
  "invitation_code": "PLACEHOLDER_INVITATION_CODE (string)"
}

PLACEHOLDER represents your input and its type. Replace the values and keep only the optional fields you need. Do not send string placeholders in place of numbers, booleans, objects, or arrays.

Request schema: RegisterRequest

Response

The JSON response contains code, message, and data. The data contents are described in the schemas below.

Response data schemas: User, AuthResponse. See the Data schemas pages for fields and types.

Where several response variants are possible, their fields are listed in separate schemas; do not combine them into one object.

Note: this operation changes state or continues a one-time authentication flow. The example describes the contract and is not executed.

Access: no sign-in required; additional requirements are listed for the method

Rate limit: 10 requests per 60 seconds per address.

JSON / form fields

{
  "email": "PLACEHOLDER_EMAIL (string)",
  "token": "PLACEHOLDER_TOKEN (string)",
  "new_password": "PLACEHOLDER_NEW_PASSWORD (string)"
}

PLACEHOLDER represents your input and its type. Replace the values and keep only the optional fields you need. Do not send string placeholders in place of numbers, booleans, objects, or arrays.

Request schema: ResetPasswordRequest

Response

The JSON response contains code, message, and data. The data contents are described in the schemas below.

Response data schemas: ResetPasswordResponse. See the Data schemas pages for fields and types.

{
  "code": 0,
  "message": "success",
  "data": {
    "message": "PLACEHOLDER_MESSAGE (string)"
  }
}

Note: this operation changes state or continues a one-time authentication flow. The example describes the contract and is not executed.

Access: Dashboard token

No request body is required.

Response

The JSON response contains code, message, and data. The data contents are described in the schemas below.

Response data schemas: RevokeAllSessionsResponse. See the Data schemas pages for fields and types.

{
  "code": 0,
  "message": "success",
  "data": {
    "message": "PLACEHOLDER_MESSAGE (string)"
  }
}

Note: all personal data and objects are scoped to the JWT subject.

Note: this operation changes state or continues a one-time authentication flow. The example describes the contract and is not executed.

Access: no sign-in required; additional requirements are listed for the method

Rate limit: 5 requests per 60 seconds per address.

JSON / form fields

{
  "email": "PLACEHOLDER_EMAIL (string)",
  "turnstile_token": "PLACEHOLDER_TURNSTILE_TOKEN (string)"
}

PLACEHOLDER represents your input and its type. Replace the values and keep only the optional fields you need. Do not send string placeholders in place of numbers, booleans, objects, or arrays.

Request schema: SendVerifyCodeRequest

Response

The JSON response contains code, message, and data. The data contents are described in the schemas below.

Response data schemas: SendVerifyCodeResponse. See the Data schemas pages for fields and types.

{
  "code": 0,
  "message": "success",
  "data": {
    "message": "PLACEHOLDER_MESSAGE (string)",
    "countdown": "PLACEHOLDER_COUNTDOWN (integer)"
  }
}

Note: this operation changes state or continues a one-time authentication flow. The example describes the contract and is not executed.

Access: no sign-in required; additional requirements are listed for the method

Feature availability and additional access requirements are checked when the request is processed.

Rate limit: 10 requests per 60 seconds per address.

JSON / form fields

{
  "code": "PLACEHOLDER_CODE (string)"
}

PLACEHOLDER represents your input and its type. Replace the values and keep only the optional fields you need. Do not send string placeholders in place of numbers, booleans, objects, or arrays.

Request schema: ValidateInvitationCodeRequest

Response

The JSON response contains code, message, and data. The data contents are described in the schemas below.

Response data schemas: ValidateInvitationCodeResponse. See the Data schemas pages for fields and types.

{
  "code": 0,
  "message": "success",
  "data": {
    "valid": "PLACEHOLDER_VALID (boolean)",
    "error_code": "PLACEHOLDER_ERROR_CODE (string)"
  }
}

Notes: This method checks the invitation without redeeming the code; the example describes the contract and is not executed.

Access: no sign-in required; additional requirements are listed for the method

Feature availability and additional access requirements are checked when the request is processed.

Rate limit: 10 requests per 60 seconds per address.

JSON / form fields

{
  "code": "PLACEHOLDER_CODE (string)"
}

PLACEHOLDER represents your input and its type. Replace the values and keep only the optional fields you need. Do not send string placeholders in place of numbers, booleans, objects, or arrays.

Request schema: ValidatePromoCodeRequest

Response

The JSON response contains code, message, and data. The data contents are described in the schemas below.

Response data schemas: ValidatePromoCodeResponse. See the Data schemas pages for fields and types.

{
  "code": 0,
  "message": "success",
  "data": {
    "valid": "PLACEHOLDER_VALID (boolean)",
    "bonus_amount": "PLACEHOLDER_BONUS_AMOUNT (number)",
    "error_code": "PLACEHOLDER_ERROR_CODE (string)",
    "message": "PLACEHOLDER_MESSAGE (string)"
  }
}

Notes: This method checks the promo code without awarding a bonus; the example describes the contract and is not executed.