diff --git a/authentication.yaml b/authentication.yaml index b57fbfe..e0bf2f8 100644 --- a/authentication.yaml +++ b/authentication.yaml @@ -742,6 +742,76 @@ paths: status: success data: message: You've been logged out! + /api/v1/loginCode.redeem: + post: + tags: + - Authentication + summary: Redeem Login Code + description: |- + Redeems a one-time login code for a login token. When the modern server-side OAuth flow is enabled through the `Accounts_OAuth_Use_Modern_Flow` setting, the server completes the OAuth login and redirects the browser back to the workspace with a `loginCode` query parameter. Call this endpoint with that code to get the `loginToken` and `userId` for the session. Pass the `loginToken` as the `X-Auth-Token` header and the `userId` as the `X-User-Id` header in later requests. + + The endpoint does not require an authenticated session. It is rate-limited to 10 requests per minute per caller. Each code is a 64-character string, is single-use, and expires 60 seconds after it is issued. + + ### Changelog + | Version | Description | + | ------- | ----------- | + | 8.7.0 | Added | + operationId: post-api-v1-loginCode.redeem + requestBody: + content: + application/json: + schema: + type: object + properties: + code: + type: string + description: The one-time login code issued by the server-side OAuth flow. It must be exactly 64 characters long. + example: 4f1d2c3b4a5968778695a4b3c2d1e0f1123456789abcdef00fedcba987654321 + required: + - code + examples: + Example 1: + value: + code: 4f1d2c3b4a5968778695a4b3c2d1e0f1123456789abcdef00fedcba987654321 + responses: + '200': + description: OK + content: + application/json: + schema: + type: object + properties: + loginToken: + type: string + userId: + type: string + success: + type: boolean + examples: + Redemption successful: + value: + loginToken: 9HqLlyZOugoStsXCUfD_0YdwnNnunAJF8V47U3QHXSq + userId: aobEdbYhXfu5hkeqG + success: true + '400': + description: Bad Request + content: + application/json: + schema: + type: object + properties: + success: + type: boolean + error: + type: string + # + examples: + Invalid or expired code: + value: + success: false + error: error-invalid-code + '401': + $ref: '#/components/responses/authorizationError' /api/v1/me: get: tags: @@ -1121,14 +1191,14 @@ paths: - Two-Factor Authentication summary: Send Two-Factor Challenge Email Code description: |- - Sends a two-factor authentication code by email for an in-progress login challenge. Use this endpoint after a login attempt returns a `challengeId` for the email two-factor method, to deliver a fresh code to the user. + Sends a two-factor authentication code by email for an in-progress login challenge. When a user signs in through the server-side OAuth flow and their account requires email two-factor authentication, the server issues a `challengeId` and sends an initial code automatically. Use this endpoint with that `challengeId` to deliver a fresh code to the user. The endpoint does not require an authenticated session. It is rate-limited to 5 requests per minute per caller. The challenge must exist, must not be expired, and must use the `email` method. ### Changelog | Version | Description | | ------- | ----------- | - | 8.5.0 | Added | + | 8.7.0 | Added | operationId: post-api-v1-twoFactorChallenges.sendEmailCode requestBody: content: @@ -1194,14 +1264,14 @@ paths: - Two-Factor Authentication summary: Verify Two-Factor Challenge description: |- - Verifies a two-factor authentication code submitted against a pending challenge and, on success, returns a login token for the associated user. Use this endpoint to complete the second factor of a login flow that issued a `challengeId`. + Verifies a two-factor authentication code submitted against a pending challenge and, on success, returns a login token for the associated user. Use this endpoint to complete the second factor of a server-side OAuth login that issued a `challengeId`. It supports the `email` and `totp` challenge methods. The endpoint does not require an authenticated session. It is rate-limited to 5 requests per minute per caller. Exceeding the per-user maximum failed attempts removes the challenge and returns a `totp-max-attempts` error. ### Changelog | Version | Description | | ------- | ----------- | - | 8.5.0 | Added | + | 8.7.0 | Added | operationId: post-api-v1-twoFactorChallenges.verifyChallenge requestBody: content: diff --git a/integrations.yaml b/integrations.yaml index 099d282..4c60018 100644 --- a/integrations.yaml +++ b/integrations.yaml @@ -482,6 +482,174 @@ paths: success: false error: 'must have required property ''id'' [invalid-params]' errorType: invalid-params + /api/v1/integrations.clearHistory: + post: + tags: + - Integration + summary: Clear Integration History + description: |- + Clear the history of an outgoing integration. This endpoint replaces the deprecated `clearIntegrationHistory` DDP method, which is scheduled for removal in version 9.0.0. + + Any of the following permissions is required: + * `manage-outgoing-integrations` + * `manage-own-outgoing-integrations` (clears history only for integrations created by the calling user) + + ### Changelog + |Version | Description | + | ---------------- | ------------| + |8.7.0 | Added | + operationId: post-api-v1-integrations.clearHistory + parameters: + - $ref: '#/components/parameters/X-Auth-Token' + - $ref: '#/components/parameters/X-User-Id' + requestBody: + content: + application/json: + schema: + type: object + properties: + integrationId: + type: string + description: The ID of the integration whose history you want to clear. + example: nvdQuJQ6tE9HRFBzd + required: + - integrationId + examples: + Example 1: + value: + integrationId: nvdQuJQ6tE9HRFBzd + responses: + '200': + description: OK + content: + application/json: + schema: + type: object + properties: + success: + type: boolean + examples: + Success Example: + value: + success: true + '400': + description: Bad Request + content: + application/json: + schema: + type: object + properties: + success: + type: boolean + error: + type: string + errorType: + type: string + examples: + Example 1: + value: + success: false + error: 'must have required property ''integrationId'' [invalid-params]' + errorType: invalid-params + Example 2: + value: + success: false + error: 'Invalid integration [error-invalid-integration]' + errorType: error-invalid-integration + Example 3: + value: + success: false + error: 'Unauthorized [not_authorized]' + errorType: not_authorized + '401': + $ref: '#/components/responses/authorizationError' + /api/v1/integrations.replayOutgoing: + post: + tags: + - Integration + summary: Replay Outgoing Integration + description: |- + Replay a history entry of an outgoing integration, triggering the integration again with the recorded data. This endpoint replaces the deprecated `replayOutgoingIntegration` DDP method, which is scheduled for removal in version 9.0.0. + + Any of the following permissions is required: + * `manage-outgoing-integrations` + * `manage-own-outgoing-integrations` (replays only integrations created by the calling user) + + ### Changelog + |Version | Description | + | ---------------- | ------------| + |8.7.0 | Added | + operationId: post-api-v1-integrations.replayOutgoing + parameters: + - $ref: '#/components/parameters/X-Auth-Token' + - $ref: '#/components/parameters/X-User-Id' + requestBody: + content: + application/json: + schema: + type: object + properties: + integrationId: + type: string + description: The ID of the outgoing integration. + example: nvdQuJQ6tE9HRFBzd + historyId: + type: string + description: The ID of the integration history entry to replay. Use the Get Integration History endpoint to list history entries. + example: 8G2GfBz3prSampleId + required: + - integrationId + - historyId + examples: + Example 1: + value: + integrationId: nvdQuJQ6tE9HRFBzd + historyId: 8G2GfBz3prSampleId + responses: + '200': + description: OK + content: + application/json: + schema: + type: object + properties: + success: + type: boolean + examples: + Success Example: + value: + success: true + '400': + description: Bad Request + content: + application/json: + schema: + type: object + properties: + success: + type: boolean + error: + type: string + errorType: + type: string + examples: + Example 1: + value: + success: false + error: 'must have required property ''historyId'' [invalid-params]' + errorType: invalid-params + Example 2: + value: + success: false + error: 'Invalid integration [error-invalid-integration]' + errorType: error-invalid-integration + Example 3: + value: + success: false + error: 'Invalid Integration History [error-invalid-integration-history]' + errorType: error-invalid-integration-history + '401': + $ref: '#/components/responses/authorizationError' /api/v1/integrations.list: get: tags: diff --git a/miscellaneous.yaml b/miscellaneous.yaml index 57d97ac..18d59a8 100644 --- a/miscellaneous.yaml +++ b/miscellaneous.yaml @@ -1259,6 +1259,88 @@ paths: '403': $ref: '#/components/responses/forbiddenError' + # TODO: Confirm the developer.rocket.chat slug for the "Add License" endpoint referenced in the description below. + /api/v1/licenses.validate: + post: + tags: + - Licenses + summary: Validate License + description: |- +
Premium tag
+ + Validates a Rocket.Chat license against the current workspace without applying it. Use this endpoint to preview a license before applying it with the Add License endpoint. It accepts both V2 and V3 (JWT) license formats. + + A valid license returns a success response. An invalid or implausible license returns a failure response with the validation behaviors that rejected it listed in the `reasons` array. + + Permission required: `edit-privileged-setting`. + ### Changelog + | Version | Description | + | ---------------- | ------------| + |8.7.0 | Added | + operationId: post-api-v1-licenses.validate + parameters: + - $ref: '#/components/parameters/Auth-Token' + - $ref: '#/components/parameters/UserId' + requestBody: + content: + application/json: + schema: + type: object + properties: + license: + type: string + description: The encrypted license string to validate. + required: + - license + examples: + Example: + value: + license: VFJ0vHf3Jm9AR0minB342MLaHRlZdc3Du5nf0E5Sv0QJ4SUkEIaU2boCYaDsxQ2N1UL4uhLjCF9M7iCZ/yxafJjxbHvOu1D5rOfdgO4RKlAGE9tGHDidJR9crJyXVb16jPHHvLSkUFzb7HoIq/nUXxU8gEgT3uJ9u2+Dw5ukDLX3SG2AFq1hLoPSZqsP6g2AQo= + # TODO: Verify the exact 400 body shape and status code returned by API.v1.failure for an invalid license (error string 'license-invalid' and reasons[] items). + responses: + '200': + $ref: '#/components/responses/trueSuccess' + '400': + description: Bad Request + content: + application/json: + schema: + type: object + properties: + success: + type: boolean + error: + type: string + reasons: + type: array + items: + type: object + properties: + behavior: + type: string + reason: + type: string + modules: + type: array + items: + type: string + limit: + type: string + examples: + Invalid License: + value: + success: false + error: license-invalid + reasons: + - behavior: prevent_installation + reason: url + - behavior: invalidate_license + reason: period + '401': + $ref: '#/components/responses/authorizationError' + '403': + $ref: '#/components/responses/forbiddenError' + /licenses.maxActiveUsers: get: tags: diff --git a/rooms.yaml b/rooms.yaml index 362e1d9..3eac99b 100644 --- a/rooms.yaml +++ b/rooms.yaml @@ -4526,7 +4526,13 @@ paths: summary: Convert Channel to Team description: |- Convert a channel to a team. - Permissions required: `create-team`, `edit-room` + + Permissions required: `create-team`, `edit-room`. Both permissions are checked against the target channel regardless of whether you identify it by `channelId` or `channelName`. Callers without both permissions on that channel receive a `403 Forbidden` response. + + ### Changelog + | Version | Description | + | ------- | ----------- | + | 8.7.0 | Added room-access check; unauthorized callers now receive 403. | operationId: post-api-v1-channels.convertToTeam parameters: - $ref: '#/components/parameters/Auth-Token' @@ -4594,6 +4600,22 @@ paths: success: true '401': $ref: '#/components/responses/authorizationError' + '403': + description: Forbidden + content: + application/json: + schema: + type: object + properties: + success: + type: boolean + error: + type: string + examples: + Permission Error: + value: + success: false + error: unauthorized /api/v1/rooms.saveNotification: post: tags: @@ -4726,6 +4748,7 @@ paths: ### Changelog | Version | Description | | ------- |--------------| + | 8.7.0 | Restored `customFields` in the response | | 2.4.0 | Added | operationId: get-api-v1-rooms.adminRooms parameters: @@ -4808,6 +4831,9 @@ paths: type: string announcement: type: string + customFields: + type: object + description: The custom fields set on the room. count: type: integer offset: @@ -4834,6 +4860,9 @@ paths: name: kim.jane ro: false default: false + customFields: + department: engineering + priority: high count: 1 offset: 0 total: 1 @@ -6163,6 +6192,7 @@ paths: ### Changelog | Version | Description | | ------- | --------------- | + | 8.7.0 | Restored `customFields` in the response | | 2.4.0 | Added | operationId: get-api-v1-rooms.adminRooms.getRoom parameters: @@ -6206,6 +6236,9 @@ paths: type: boolean default: type: boolean + customFields: + type: object + description: The custom fields set on the room. success: type: boolean examples: @@ -6222,6 +6255,9 @@ paths: username: bruno.raymundo ro: false default: false + customFields: + department: engineering + priority: high success: true '401': $ref: '#/components/responses/authorizationError' @@ -7341,9 +7377,14 @@ paths: - Teams summary: Create a New Team description: |- - Create a new public or private team in the workspace. - - Permission required: `create-team` + Create a new public or private team in the workspace. + + Permission required: `create-team`. When you create a team from an existing room by passing `room.id`, you must also hold `edit-room` on that room. Callers without both permissions on that room receive a `403 Forbidden` response. + + ### Changelog + | Version | Description | + | ------- | ----------- | + | 8.7.0 | Added room-access check when creating a team from a room (403). | operationId: post-api-v1-teams.create parameters: - $ref: '#/components/parameters/Auth-Token' @@ -7368,6 +7409,9 @@ paths: room: type: object properties: + id: + type: string + description: The ID of an existing room to convert into the new team. Requires the `edit-room` permission on that room. readOnly: type: boolean sidepanel: @@ -7450,6 +7494,22 @@ paths: success: true '401': $ref: '#/components/responses/authorizationError' + '403': + description: Forbidden + content: + application/json: + schema: + type: object + properties: + success: + type: boolean + error: + type: string + examples: + Permission Error: + value: + success: false + error: unauthorized /api/v1/teams.listAll: get: tags: diff --git a/settings.yaml b/settings.yaml index f1791e2..e96c556 100644 --- a/settings.yaml +++ b/settings.yaml @@ -675,6 +675,70 @@ paths: parameters: - $ref: '#/components/parameters/X-User-Id' - $ref: '#/components/parameters/X-Auth-Token' + /api/v1/cloud.connectWorkspace: + post: + summary: Connect Workspace to Cloud + operationId: post-api-v1-cloud.connectWorkspace + description: |- + Connect the workspace to Rocket.Chat Cloud using a registration token. This endpoint replaces the deprecated `cloud:connectWorkspace` DDP method, which is scheduled for removal in version 9.0.0. + + Permission required: `manage-cloud`. + + ### Changelog + | Version | Description | + | ---------------- | ------------| + |8.7.0 | Added | + tags: + - Cloud + parameters: + - $ref: '#/components/parameters/X-User-Id' + - $ref: '#/components/parameters/X-Auth-Token' + requestBody: + content: + application/json: + schema: + type: object + properties: + token: + type: string + description: The registration token from your Rocket.Chat Cloud account. + example: aBcDeFgHiJkLmNoP + required: + - token + examples: + Example 1: + value: + token: aBcDeFgHiJkLmNoP + responses: + '200': + $ref: '#/components/responses/trueSuccess' + '400': + description: Bad Request + content: + application/json: + schema: + type: object + properties: + success: + type: boolean + error: + type: string + errorType: + type: string + examples: + Example 1: + value: + success: false + error: 'must have required property ''token'' [invalid-params]' + errorType: invalid-params + Example 2: + value: + success: false + error: Failed to connect the workspace with Rocket.Chat Cloud + '401': + $ref: '#/components/responses/authorizationError' + '403': + $ref: '#/components/responses/forbiddenError' /api/v1/dns.resolve.txt: parameters: [] post: @@ -3248,6 +3312,9 @@ paths: type: string _id: type: string + current: + type: boolean + description: Whether the session belongs to the device making the request. total: type: integer count: @@ -3274,6 +3341,7 @@ paths: ip: 172.20.0.2 loginAt: '2023-05-23T16:33:45.202Z' _id: QoYYFw2t9oKks2niG + current: true - sessionId: WJ2giBwm4B9mcojFi userId: rbAXPnMktTFbNpwtJ device: @@ -3288,6 +3356,7 @@ paths: ip: 172.20.0.2 loginAt: '2023-05-23T12:43:52.023Z' _id: WJ2giBwm4B9mcojFi + current: false total: 2 count: 50 offset: 0 @@ -3297,11 +3366,12 @@ paths: description: |-
Premium tag
- Retrieves all sessions of the authenticated user making the request. + Retrieves all sessions of the authenticated user making the request. Each session in the response includes a `current` field that is `true` for the session of the device making the request. ### Changelog | Version | Description | | ---------------- | ------------| + |8.7.0 | Added `current` field to each session in the response | |5.0.0 | Added | tags: - Device Management diff --git a/statistics.yaml b/statistics.yaml index 8710976..610df95 100644 --- a/statistics.yaml +++ b/statistics.yaml @@ -23,8 +23,9 @@ paths: Permission required: `view-statistics` ### Changelog - | Version | Description | + | Version | Description | | ---------------- | ------------| + |8.7.0 | Added the `fips` field to statistics records. | |0.51.0 | Added | operationId: get-api-v1-statistics.list parameters: @@ -218,6 +219,9 @@ paths: type: string platform: type: string + fips: + type: boolean + description: Whether the workspace is running in FIPS mode. Statistics records created before version 8.7.0 don't include this field. readReceiptsEnabled: type: boolean readReceiptsDetailed: @@ -729,8 +733,9 @@ paths: Permission required: `view-statistics` ### Changelog - | Version | Description | + | Version | Description | | ---------------- | ------------| + |8.7.0 | Added the `fips` field to the response. | |0.51.0 | Added | operationId: get-api-v1-statistics parameters: @@ -1007,6 +1012,9 @@ paths: type: string platform: type: string + fips: + type: boolean + description: Whether the workspace is running in FIPS mode. readReceiptsEnabled: type: boolean readReceiptsDetailed: @@ -1762,6 +1770,7 @@ paths: type: string success: type: boolean + # x-examples: Success Example: _id: 6683e080ffe932842327bf81 @@ -2328,6 +2337,7 @@ paths: _updatedAt: '2024-07-02T11:12:14.147Z' statsToken: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ3b3Jrc3BhY2VJZCI6IiIsInVuaXF1ZUlkIjoiMGVkNWIxYzctODc2Mi00NjAzLWJhZGQtY2YzNWYwZTYzNWQzIiwicmVjb3JkSWQiOiI2NjgzZTA4MGZmZTkzMjg0MjMyN2JmODEiLCJ0aW1lc3RhbXAiOiIyMDI0LTA3LTAyVDExOjEyOjEyLjAyOTU4ODQ4OVoiLCJpbmZvIjp7fX0.l0vBdjR7Oyk7yfw7hwvJe9tlfnWLkiXJ5ysGxLqqx6g_2NvjvogsapFZvwCpyiH1JadvysiNNF53jeDfmG95yfn2sFpGLJXCjACPMHYTkTZ2jiPe7pqm62SFnlnSTU_9ietfUMXkxt21FgOrtDrS9HjiCw1g4Sxd-khz71E6p9OgdnGmOs8YWSSP-ejflEr-H6cOXoXktizgDQXlreF7ggwuov9G6Y4uXsnj8wouU_HNwAJua0pInTiyFe6ZM9TXdtfC-4ghpCT1ccGynKPC4HQT3g_RCCMkTG5A-IeSD5D1hGWhgTfHza0W7f7s4r_Ly0G2FBAgJ_54ykc4FNdbDw success: true + # examples: Success Example: value: diff --git a/user-management.yaml b/user-management.yaml index 1a2851e..a472452 100644 --- a/user-management.yaml +++ b/user-management.yaml @@ -182,6 +182,191 @@ paths: - $ref: '#/components/parameters/Auth-Token' tags: - Permissions + /api/v1/permissions.addRole: + post: + tags: + - Permissions + summary: Add Role to Permission + description: |- + Grant a permission to a role. This endpoint replaces the deprecated `authorization:addPermissionToRole` DDP method, which is scheduled for removal in version 9.0.0. + + Permission required: `access-permissions`. To modify a setting-level permission, the `access-setting-permissions` permission is also required. + + ### Changelog + | Version | Description | + | ---------------- | ------------| + |8.7.0 | Added | + operationId: post-api-v1-permissions.addRole + parameters: + - $ref: '#/components/parameters/UserId' + - $ref: '#/components/parameters/Auth-Token' + requestBody: + content: + application/json: + schema: + type: object + properties: + permissionId: + type: string + description: The permission ID. + example: access-permissions + role: + type: string + description: The role to grant the permission to. For default Rocket.Chat roles, enter the role name, such as `admin`. For custom roles, enter the role ID. + example: admin + required: + - permissionId + - role + examples: + Example 1: + value: + permissionId: access-permissions + role: admin + responses: + '200': + $ref: '#/components/responses/trueSuccess' + '400': + description: Bad Request + content: + application/json: + schema: + type: object + properties: + success: + type: boolean + error: + type: string + errorType: + type: string + examples: + Example 1: + value: + success: false + error: 'must have required property ''role'' [invalid-params]' + errorType: invalid-params + Example 2: + value: + success: false + error: 'Adding permission is not allowed [error-action-not-allowed]' + errorType: error-action-not-allowed + Example 3: + value: + success: false + error: 'Permission does not exist [error-invalid-permission]' + errorType: error-invalid-permission + Example 4: + value: + success: false + error: 'Role does not exist [error-invalid-role]' + errorType: error-invalid-role + '401': + $ref: '#/components/responses/authorizationError' + '403': + description: Forbidden + content: + application/json: + schema: + type: object + properties: + success: + type: boolean + error: + type: string + examples: + Permission Error: + value: + success: false + error: 'User does not have the permissions required for this action [error-unauthorized]' + /api/v1/permissions.removeRole: + post: + tags: + - Permissions + summary: Remove Role from Permission + description: |- + Revoke a permission from a role. This endpoint replaces the deprecated `authorization:removeRoleFromPermission` DDP method, which is scheduled for removal in version 9.0.0. + + Permission required: `access-permissions`. To modify a setting-level permission, the `access-setting-permissions` permission is also required. + + ### Changelog + | Version | Description | + | ---------------- | ------------| + |8.7.0 | Added | + operationId: post-api-v1-permissions.removeRole + parameters: + - $ref: '#/components/parameters/UserId' + - $ref: '#/components/parameters/Auth-Token' + requestBody: + content: + application/json: + schema: + type: object + properties: + permissionId: + type: string + description: The permission ID. + example: access-permissions + role: + type: string + description: The role to revoke the permission from. For default Rocket.Chat roles, enter the role name, such as `admin`. For custom roles, enter the role ID. + example: admin + required: + - permissionId + - role + examples: + Example 1: + value: + permissionId: access-permissions + role: admin + responses: + '200': + $ref: '#/components/responses/trueSuccess' + '400': + description: Bad Request + content: + application/json: + schema: + type: object + properties: + success: + type: boolean + error: + type: string + errorType: + type: string + examples: + Example 1: + value: + success: false + error: 'must have required property ''role'' [invalid-params]' + errorType: invalid-params + Example 2: + value: + success: false + error: 'Removing permission is not allowed [error-action-not-allowed]' + errorType: error-action-not-allowed + Example 3: + value: + success: false + error: 'Permission not found [error-permission-not-found]' + errorType: error-permission-not-found + '401': + $ref: '#/components/responses/authorizationError' + '403': + description: Forbidden + content: + application/json: + schema: + type: object + properties: + success: + type: boolean + error: + type: string + examples: + Permission Error: + value: + success: false + error: 'User does not have the permissions required for this action [error-unauthorized]' /api/v1/roles.create: post: tags: @@ -2393,6 +2578,7 @@ paths: ### Changelog | Version | Description | | ---------------- | ------------| + |8.7.0 | Added optional `service` form-data field to set the avatar origin. | |0.56.0 | Add support for `username` argument. | |0.48.0 | Set other users avatars if the callee has permission. | |0.46.0 | Added | @@ -2423,7 +2609,7 @@ paths: avatarUrl: 'http://domain.tld/to/my/own/avatar.jpg' description: |- You have two options to set the user avatar: - * Upload the image file to use as the new avatar, as form-data. For example, `image=@my-own-avatar.png`. + * Upload the image file to use as the new avatar, as form-data. For example, `image=@my-own-avatar.png`. Optionally, include a `service` form-data field with the name of the avatar service the image comes from (for example, an OAuth provider). When `service` is set, the `image` field is read as the image URL or data URI supplied by that service, and the service name is stored as the user's avatar origin. It replaces the deprecated `setAvatarFromService` DDP method, which is scheduled for removal in version 9.0.0. * Enter the image URL you want to set as the user avatar in the request body, using the parameter `avatarUrl`. tags: - Users @@ -3203,12 +3389,13 @@ paths: As a workspace admin, you can create temporary authentication tokens for users. This is the same type of session authentication token a user gets via login and expires the same way. * To use this endpoint, you must set a secret with the `CREATE_TOKENS_FOR_USERS_SECRET` environment variable in your deployment configuration. This secret will be used to authorize all requests made to this endpoint. * For SaaS workspaces, contact support to set this variable. - * Permission required: `user-generate-access-token` + * Permission required: `user-generate-access-token`. This permission is enforced only when you generate a token for another user; it is not required when you generate a token for your own account. Callers without this permission receive a `Not authorized [error-not-authorized]` error. * The maximum number of login tokens per user is 50. See this GitHub PR for details. - + ### Changelog | Version | Description | | ---------------- | ------------| + |8.7.0 | Enforced `user-generate-access-token` for other users' tokens.| |8.0.0 | Added `CREATE_TOKENS_FOR_USERS_SECRET` environment variable to define a shared secret that will be used to authorize this endpoint.| |2.1.0 | Added ENV VAR to be able to use this endpoint (process.env.CREATE_TOKENS_FOR_USERS). | |0.56.0 | Added | @@ -3290,8 +3477,14 @@ paths: success: false error: 'Not authorized [error-not-authorized]' errorType: error-not-authorized + Missing permission: + value: + success: false + error: 'Not authorized [error-not-authorized]' + errorType: error-not-authorized '401': $ref: '#/components/responses/authorizationError' + # parameters: [] /api/v1/users.getPreferences: get: @@ -5001,7 +5194,13 @@ paths: parameters: - $ref: '#/components/parameters/Auth-Token' - $ref: '#/components/parameters/UserId' - description: Log out of your account. You can also log out of another user's session. You will need the `logout-other-user` permission. + description: |- + Log out of your account. You can also log out of another user's session. You will need the `logout-other-user` permission. + + ### Changelog + | Version | Description | + | ---------------- | ------------| + |8.7.0 | Post-logout cleanup hooks now also run on REST logout. | requestBody: content: application/json: @@ -5011,6 +5210,76 @@ paths: userId: type: string description: Enter the user ID to be logged out. + /api/v1/users.verifyEmail: + post: + tags: + - Users + summary: Verify User Email + description: |- + Verify a user's email address with the verification token that Rocket.Chat sends by email. The server marks the email as verified and, if the user has the `anonymous` role, replaces it with the `user` role in the same request. This endpoint replaces the two-step DDP flow of the `verifyEmail` and `afterVerifyEmail` methods; the `afterVerifyEmail` DDP method is deprecated and scheduled for removal in version 9.0.0. + + This endpoint does not require authentication. + + + ### Changelog + | Version | Description | + | ---------------- | ------------| + |8.7.0 | Added | + operationId: post-api-v1-users.verifyEmail + requestBody: + content: + application/json: + schema: + type: object + properties: + token: + type: string + description: The email verification token the user received by email. + example: hf5Wf4Kj9R3mR7cQ2xkPd + required: + - token + examples: + Example 1: + value: + token: hf5Wf4Kj9R3mR7cQ2xkPd + responses: + '200': + $ref: '#/components/responses/trueSuccess' + '400': + description: Bad Request + content: + application/json: + schema: + type: object + properties: + success: + type: boolean + error: + type: string + errorType: + type: string + examples: + Example 1: + value: + success: false + error: 'must have required property ''token'' [invalid-params]' + errorType: invalid-params + '404': + description: Not Found. Returned when the verification token does not match any user. + content: + application/json: + schema: + type: object + properties: + success: + type: boolean + error: + type: string + examples: + Example 1: + value: + success: false + error: Resource not found /api/v1/ldap.syncNow: post: tags: