Profile and security

Methods, request fields, and responses.

Full guide

This section contains 6 methods. Open a method to view access requirements, request fields, and the response.

Method and path	Description	Access
`PUT /api/v1/user`	Update profile	Dashboard token
`GET /api/v1/user/passkeys`	List passkeys	Dashboard token
`PUT /api/v1/user/password`	Change password	Dashboard token
`GET /api/v1/user/profile`	Profile, balance, and bindings	Dashboard token
`GET /api/v1/user/totp/status`	2FA status (TOTP)	Dashboard token
`GET /api/v1/user/totp/verification-method`	TOTP verification method	Dashboard token

PUT /api/v1/user — Update profile

Access: Dashboard token

PUT/api/v1/user

JSON / form fields

The field	Type	Required	Validation / description
`username`	`string`	no	; may be null
`avatar_url`	`string`	no	; may be null
`balance_notify_enabled`	`boolean`	no	; may be null
`balance_notify_threshold`	`number`	no	; may be null

Request body template

{
  "username": "PLACEHOLDER_USERNAME (string)",
  "avatar_url": "PLACEHOLDER_AVATAR_URL (string)",
  "balance_notify_enabled": "PLACEHOLDER_BALANCE_NOTIFY_ENABLED (boolean)",
  "balance_notify_threshold": "PLACEHOLDER_BALANCE_NOTIFY_THRESHOLD (number)"
}

PLACEHOLDER represents your input and its type. Replace the values and keep only the optional fields you need. Do not send string placeholders in place of numbers, booleans, objects, or arrays.

Request schema: UpdateProfileRequest

Response

The JSON response contains code, message, and data. The data contents are described in the schemas below.

Response data schemas: User, UserProfileResponse. See the Data schemas pages for fields and types.

Response schema with illustrative values

{
  "code": 0,
  "message": "success",
  "data": {
    "id": "PLACEHOLDER_ID (integer)",
    "email": "PLACEHOLDER_EMAIL (string)",
    "username": "PLACEHOLDER_USERNAME (string)",
    "role": "PLACEHOLDER_ROLE (string)",
    "balance": "PLACEHOLDER_BALANCE (number)",
    "frozen_balance": "PLACEHOLDER_FROZEN_BALANCE (number)",
    "concurrency": "PLACEHOLDER_CONCURRENCY (integer)",
    "status": "PLACEHOLDER_STATUS (string)",
    "last_active_at": "PLACEHOLDER_LAST_ACTIVE_AT (string)",
    "created_at": "PLACEHOLDER_CREATED_AT (string)",
    "updated_at": "PLACEHOLDER_UPDATED_AT (string)",
    "deleted_at": "PLACEHOLDER_DELETED_AT (string)",
    "balance_notify_enabled": "PLACEHOLDER_BALANCE_NOTIFY_ENABLED (boolean)",
    "balance_notify_threshold_type": "PLACEHOLDER_BALANCE_NOTIFY_THRESHOLD_TYPE (string)",
    "balance_notify_threshold": "PLACEHOLDER_BALANCE_NOTIFY_THRESHOLD (number)",
    "balance_notify_extra_emails": "PLACEHOLDER_BALANCE_NOTIFY_EXTRA_EMAILS (array)",
    "total_recharged": "PLACEHOLDER_TOTAL_RECHARGED (number)",
    "rpm_limit": "PLACEHOLDER_RPM_LIMIT (integer)",
    "api_keys": "PLACEHOLDER_API_KEYS (array)",
    "avatar_url": "PLACEHOLDER_AVATAR_URL (string)",
    "email_bound": "PLACEHOLDER_EMAIL_BOUND (boolean)"
  }
}

Note: all personal data and objects are scoped to the JWT subject.

Note: this operation changes state or continues a one-time authentication flow. The example describes the contract and is not executed.

Note: key spending limits (quota, quota_used) are returned in key responses, not in the profile. frozen_balance is the reserved amount; do not treat it as available balance.

GET /api/v1/user/passkeys — List passkeys

Access: Dashboard token

GET/api/v1/user/passkeys

Read operation; use an ID from your previous response

curl --fail-with-body "https://ailoot.ai/api/v1/user/passkeys" \
  -H "Authorization: Bearer $TOKEN"

No request body is required. Send the parameters listed above in the URL.

Response

The JSON response contains code, message, and data. The data contents are described in the schemas below.

Response data schemas: PasskeyCredentialSummary. See the Data schemas pages for fields and types.

Response schema with illustrative values

{
  "code": 0,
  "message": "success",
  "data": {
    "id": "PLACEHOLDER_ID (integer)",
    "name": "PLACEHOLDER_NAME (string)",
    "created_at": "PLACEHOLDER_CREATED_AT (string)",
    "last_used_at": "PLACEHOLDER_LAST_USED_AT (string)",
    "backup": "PLACEHOLDER_BACKUP (boolean)"
  }
}

Note: all personal data and objects are scoped to the JWT subject.

Note: credential comes from navigator.credentials; session_token comes from begin. The finish body must be <=65536 bytes. Registration and deletion require a password.

PUT /api/v1/user/password — Change password

Access: Dashboard token

PUT/api/v1/user/password

JSON / form fields

The field	Type	Required	Validation / description
`old_password`	`string`	yes	required
`new_password`	`string`	yes	required,min=6

Request body template

{
  "old_password": "PLACEHOLDER_OLD_PASSWORD (string)",
  "new_password": "PLACEHOLDER_NEW_PASSWORD (string)"
}

PLACEHOLDER represents your input and its type. Replace the values and keep only the optional fields you need. Do not send string placeholders in place of numbers, booleans, objects, or arrays.

Request schema: ChangePasswordRequest

Response

The JSON response contains code, message, and data. The data contents are described in the schemas below.

Response schema with illustrative values

{
  "code": 0,
  "message": "success",
  "data": {
    "message": "VALUE_FROM_RESPONSE"
  }
}

Note: all personal data and objects are scoped to the JWT subject.

Note: this operation changes state or continues a one-time authentication flow. The example describes the contract and is not executed.

GET /api/v1/user/profile — Profile, balance, and bindings

Access: Dashboard token

GET/api/v1/user/profile

Read operation; use an ID from your previous response

curl --fail-with-body "https://ailoot.ai/api/v1/user/profile" \
  -H "Authorization: Bearer $TOKEN"

No request body is required. Send the parameters listed above in the URL.

Response

The JSON response contains code, message, and data. The data contents are described in the schemas below.

Response data schemas: User, UserProfileResponse. See the Data schemas pages for fields and types.

Response schema with illustrative values

{
  "code": 0,
  "message": "success",
  "data": {
    "id": "PLACEHOLDER_ID (integer)",
    "email": "PLACEHOLDER_EMAIL (string)",
    "username": "PLACEHOLDER_USERNAME (string)",
    "role": "PLACEHOLDER_ROLE (string)",
    "balance": "PLACEHOLDER_BALANCE (number)",
    "frozen_balance": "PLACEHOLDER_FROZEN_BALANCE (number)",
    "concurrency": "PLACEHOLDER_CONCURRENCY (integer)",
    "status": "PLACEHOLDER_STATUS (string)",
    "last_active_at": "PLACEHOLDER_LAST_ACTIVE_AT (string)",
    "created_at": "PLACEHOLDER_CREATED_AT (string)",
    "updated_at": "PLACEHOLDER_UPDATED_AT (string)",
    "deleted_at": "PLACEHOLDER_DELETED_AT (string)",
    "balance_notify_enabled": "PLACEHOLDER_BALANCE_NOTIFY_ENABLED (boolean)",
    "balance_notify_threshold_type": "PLACEHOLDER_BALANCE_NOTIFY_THRESHOLD_TYPE (string)",
    "balance_notify_threshold": "PLACEHOLDER_BALANCE_NOTIFY_THRESHOLD (number)",
    "balance_notify_extra_emails": "PLACEHOLDER_BALANCE_NOTIFY_EXTRA_EMAILS (array)",
    "total_recharged": "PLACEHOLDER_TOTAL_RECHARGED (number)",
    "rpm_limit": "PLACEHOLDER_RPM_LIMIT (integer)",
    "api_keys": "PLACEHOLDER_API_KEYS (array)",
    "avatar_url": "PLACEHOLDER_AVATAR_URL (string)",
    "email_bound": "PLACEHOLDER_EMAIL_BOUND (boolean)"
  }
}

Note: all personal data and objects are scoped to the JWT subject.

Note: key spending limits (quota, quota_used) are returned in key responses, not in the profile. frozen_balance is the reserved amount; do not treat it as available balance.

GET /api/v1/user/totp/status — 2FA status (TOTP)

Access: Dashboard token

GET/api/v1/user/totp/status

Read operation; use an ID from your previous response

curl --fail-with-body "https://ailoot.ai/api/v1/user/totp/status" \
  -H "Authorization: Bearer $TOKEN"

No request body is required. Send the parameters listed above in the URL.

Response

The JSON response contains code, message, and data. The data contents are described in the schemas below.

Response data schemas: TotpStatusResponse. See the Data schemas pages for fields and types.

Response schema with illustrative values

{
  "code": 0,
  "message": "success",
  "data": {
    "enabled": "PLACEHOLDER_ENABLED (boolean)",
    "enabled_at": "PLACEHOLDER_ENABLED_AT (integer)",
    "feature_enabled": "PLACEHOLDER_FEATURE_ENABLED (boolean)"
  }
}

Note: all personal data and objects are scoped to the JWT subject.

Note: secret and setup_token are secrets. Verification depends on the TOTP and user settings.

GET /api/v1/user/totp/verification-method — TOTP verification method

Access: Dashboard token

GET/api/v1/user/totp/verification-method

Read operation; use an ID from your previous response

curl --fail-with-body "https://ailoot.ai/api/v1/user/totp/verification-method" \
  -H "Authorization: Bearer $TOKEN"

No request body is required. Send the parameters listed above in the URL.

Response

The JSON response contains code, message, and data. The data contents are described in the schemas below.

Response schema with illustrative values

{
  "code": 0,
  "message": "success",
  "data": {
    "method": "email"
  }
}

Note: all personal data and objects are scoped to the JWT subject.

Note: secret and setup_token are secrets. Verification depends on the TOTP and user settings.

TotpVerificationMethod

{
  "type": "object",
  "required": [
    "method"
  ],
  "properties": {
    "method": {
      "type": "string",
      "enum": [
        "email",
        "password"
      ]
    }
  }
}

Still have questions? Send your Request ID and a description — we'll help you troubleshoot.Contact support