API Reference

Fabrixly IDS exposes a complete REST API covering every aspect of identity management — from authentication flows to user management, organizations, clients, sessions, and more.

Base URL:

• For Cloud SaaS: https://ids.fabrixly.com
• For Self-hosted: https://auth.yourdomain.com

📖 Interactive API Explorer is available inside the Fabrixly Console — log in to your console (at ids.fabrixly.com/admin for cloud, or your self-hosted URL) and navigate to the API Reference section to explore and test all endpoints interactively with your live credentials.

Authentication

All protected endpoints require a Bearer token in the Authorization header:

Authorization: Bearer <access_token>

Auth & Profile APIs

Core authentication endpoints — login, OTP, magic link, token refresh, logout, and user profile management.

Covers: POST /auth/login, POST /auth/otp/send, POST /auth/otp/verify, POST /auth/magic-link/send, POST /auth/refresh, POST /auth/logout, GET /auth/me

→ Read Full Guide

User Management APIs

Endpoints for creating, reading, updating, and deleting users. Includes password reset, role assignment, and account status management.

Covers: GET /api/users, POST /api/users, GET /api/users/:id, PUT /api/users/:id, DELETE /api/users/:id, PUT /api/users/:id/password

→ Read Full Guide

Client Management APIs

Manage OAuth 2.0 clients — create public (PKCE) or confidential clients, configure allowed grant types, redirect URIs, and scopes.

Covers: GET /api/clients, POST /api/clients, GET /api/clients/:id, PUT /api/clients/:id, DELETE /api/clients/:id, POST /api/clients/:id/rotate-secret

→ Read Full Guide

Organization Management APIs

Multi-tenant organization support — create and manage organizations, control membership, configure per-org settings and branding.

Covers: GET /api/organizations, POST /api/organizations, GET /api/organizations/:id, PUT /api/organizations/:id, POST /api/organizations/:id/members, DELETE /api/organizations/:id/members/:userId

→ Read Full Guide

Role & Team Management APIs

Fine-grained access control — define roles, assign permissions, create teams within organizations, and manage team membership.

Covers: GET /api/roles, POST /api/roles, GET /api/teams, POST /api/teams, POST /api/teams/:id/members, DELETE /api/teams/:id/members/:userId

→ Read Full Guide

Session & Tenant Switcher APIs

Manage active user sessions — list sessions by device, revoke individual or all sessions, and switch between organization contexts (tenant switching).

Covers: GET /api/sessions, DELETE /api/sessions/:id, DELETE /api/sessions, POST /api/sessions/switch-tenant

→ Read Full Guide

Analytics & License Management APIs

Access usage analytics, audit logs, and license entitlement management. Track active users, login events, and enforce license limits programmatically.

Covers: GET /api/analytics/logins, GET /api/analytics/users, GET /api/licenses, POST /api/licenses, GET /api/licenses/:id/validate

→ Read Full Guide

System Settings & Template APIs

Manage global system configuration — authentication policies, token expiry, SMTP/SMS settings, and theme branding via API.

Covers: GET /api/settings, PUT /api/settings, GET /api/settings/auth-policy, PUT /api/settings/auth-policy

→ Read Full Guide

Communication Template Configuration APIs

Manage and customize email and SMS templates used by the identity server — OTP emails, magic link emails, welcome messages, and more.

Covers: GET /api/templates, GET /api/templates/:type, PUT /api/templates/:type, POST /api/templates/:type/preview

→ Read Full Guide

Public & Communication Test APIs

Test-mode endpoints for verifying your SMTP and SMS configuration without triggering real sends, plus public endpoints for health checks and OIDC discovery.

Covers: POST /api/test/send-email, POST /api/test/send-sms, GET /health, GET /.well-known/openid-configuration, GET /.well-known/jwks.json

→ Read Full Guide

Authentication Reference Guide

A comprehensive reference covering all authentication flows, token types, grant types, and OIDC/OAuth 2.0 protocol details supported by Fabrixly IDS.

Covers: Authorization Code + PKCE, Client Credentials, Hybrid Flow, Implicit Flow, Refresh Tokens, Token Introspection, Token Revocation

→ Read Full Reference

Standard HTTP Response Format

Success

{
  "success": true,
  "data": { },
  "meta": {
    "page": 1,
    "limit": 20,
    "total": 100
  }
}

Error

{
  "success": false,
  "error": {
    "code": "INVALID_CREDENTIALS",
    "message": "Email or password is incorrect",
    "status": 401
  }
}

Rate Limiting

All responses include rate limit headers:

X-RateLimit-Limit: 100
X-RateLimit-Remaining: 87
X-RateLimit-Reset: 1720435200

Related

• Examples →
• SDKs →
• FAQs →