REST API reference

Returns up to 200 tenants per page; use ?page=<n> for pagination. Tenants are returned in creation order.

Query parameters

Provisions the tenant, allocates the OIDC issuer URL, signs the first set of JWKS keys, and emits a tenant.created webhook.

Body parameters

Returns the full tenant record including the theming bundle, OIDC issuer URL, JWKS URI, and current key rotation state.

Partial updates. Only fields included in the request body are changed. Region cannot be changed; create a new tenant and migrate.

Soft-deletes the tenant. Users can no longer sign in, but identity records are retained for the audit-retention period before hard deletion. The action is irreversible after the retention window.

Requires X-Tenant-Id header. Returns applications in creation order with their last_seen_at timestamps — useful for spotting stale integrations.

Body parameters

Response. Returns the client_id and client_secret. The secret is shown once and never recoverable — store it before closing the response.

Issues a new client_secret and keeps the previous one valid for a grace window of 24 hours, so you can deploy without downtime.

Existing sessions issued to the application stop validating on the next JWKS refresh (or immediately via push-revoke). Audit entry is automatic.

Returns the full user record: sub, display name, email (if permitted by the tenant's PII visibility policy), groups, roles, last sign-in timestamp.

Used by operator-driven onboarding and migration scripts. The created user receives a magic-link email to complete setup. Tenants can disable admin-created users in their configuration.

Invalidates every refresh token issued to the user. Access tokens already in flight expire at their natural exp (max 15 minutes). For instant cutoff, pair with a push-revoke webhook handler in your application.

Body parameters

Membership change propagates within the access-token lifetime. For instant propagation, listen for the group.member.added webhook and clear your local cache.

Revokes the user's permissions inherited through this group. Refresh tokens are invalidated for this user; new access tokens reflect the change.

Returns metadata about an active session — actor, tenant, application, last refresh time, MFA factor used. Does not return the access token itself.

Invalidates the refresh token; access tokens already issued expire at their exp. Use this to handle stolen-token incidents from the operator console.

Body parameters

Response. { "allow": true, "reason": "editor-role" } or { "allow": false, "reason": "missing-grant" }. The reason string is stable and safe to display to operators.

Body parameters

Response. Returns the agent record and the bearer token. The token is shown once — store it now or rotate.

The agent calls this with its bearer token and receives a short-lived JWT carrying actor_type: "agent". Subsequent calls to consuming apps use the JWT, not the agent token.

Immediately invalidates the agent's API token and all outstanding session JWTs. Push-revoke webhook fires within ~50ms.

Body parameters

Returns provider routing details for the resource's owner. Your application uses these to create the actual charge — Kimezu does not call Stripe / Mollie / PayPal on your behalf.

Your application reports the result of a payment for VAT and OSS recording. Kimezu computes the treatment (applied / reverse-charge / outside-EU scope) from the buyer's country and VAT ID, stores it, and emits an audit entry.

Query parameters

Returns the current chain head hash. Anyone holding a copy of your audit log can recompute the chain and verify it matches — without trusting us.

Standard OIDC 1.0 discovery. Refresh on a sensible cache schedule (we suggest 24 hours; the URL itself is cacheable). Your OIDC client library reads this — you almost never read it by hand.

JWKS document. Includes kid-keyed RSA public keys. Kimezu rotates the active signing key every 24 hours (older keys remain in the JWKS until all tokens signed by them have expired).