Registry API
Sign-in and tokens
Device login, OIDC sign-in, CI tokens and the caller’s identity.
`wl login` uses the device flow: start a device code, then complete it for a user token. The dashboard signs in through OIDC. `wl ci-token` mints a token scoped to one workspace (admins only), which carries the reader role.
After a dashboard sign-in, the device check can send a new-device notice by email when the server is configured for it; it never blocks the sign-in.
Operations
| Request | What it does |
|---|---|
| GET /v1/auth/me | Return the caller’s subject and role |
| POST /v1/auth/device/start | Start device login flowin spec |
| POST /v1/auth/device/complete | Complete device login flowin spec |
| POST /v1/auth/ci-token | Create CI tokenin spec |
| GET /v1/auth/oidc/authorize | Get OIDC authorization URLin spec |
| POST /v1/auth/oidc/callback | Complete OIDC callbackin spec |
| POST /v1/auth/device-check | Record the sign-in device; notify on a new one |
Operations are the routes the server registers; this site checks its list against the route definitions. Operations marked “in spec” are also described in the committed OpenAPI file (apps/api/openapi.json), which does not yet cover every route. Only the public catalog and the health check work without a token.