Authentication

Manages sign-in, sign-out, token refresh, and service tokens.

📄️ Log Out

Log out and clear the refresh token cookie.

📄️ Refresh Access Token

Issue a new access token using the refresh token.

📄️ Get Current User

Return the currently authenticated user.

📄️ Update Me

Update the current user's display_name and/or avatar_config.

📄️ Upload Avatar

Upload an avatar image for the current user.

📄️ Delete Avatar

Delete the current user's uploaded avatar image.

Serve an avatar image with HMAC signature verification. Browsers cannot attach Authorization headers to <img src>; this endpoint authenticates via short-lived signed URLs returned from /auth/me instead.

📄️ Get Personal Prompt

Return the caller's personal prompt. Unset is a normal state, not a 404 — the editor and the per-request runtime both read this, and turning "not configured" into an error would make every turn of an unconfigured conversation log a failure.

📄️ Set Personal Prompt

Replace the caller's personal prompt.

📄️ Delete Personal Prompt

Clear the caller's personal prompt. Idempotent.

📄️ Upload Chat Attachment

Accept a conversation attachment and schedule its Markdown conversion.

📄️ Delete Chat Attachments

Delete every attachment the caller holds for one conversation. The fast path of — dhub2-agent calls this from its session delete with the user's own JWT. Idempotent: a session with no attachments, or one already swept, is a 204.

📄️ Get Chat Attachment

Return one of the caller's attachments, including conversion status. Someone else's id is a 404 here because the lookup is addressed by the caller's own parent — there is no path that reaches another user's subtree.

📄️ Change Password

Change the current user's password.