Welcome to SharePass and thank you for choosing our platform for secure data sharing.
\nThis documentation is intended for developers, technical teams, and integrators who want to work directly with the SharePass API backend to build secure secret-sharing workflows in their own applications, services, or internal tools.
\nThe base URL for the SharePass API is:
\nhttps://api.sharepass.com/v1
Throughout this documentation, you will find details about the available endpoints, authentication requirements, supported headers, request structures, and endpoint behavior.
\nThe primary authentication method for SharePass is the user access token (JWT), which is accepted across the platform. In addition, some endpoints also support API key authentication. API keys can be generated and enabled through the general settings endpoint.
\nUsing the SharePass API, you can create and manage secrets, apply access restrictions, use templates and labels, configure webhooks, manage account settings, and integrate advanced security features such as multi-factor authentication. Some endpoints are also designed for recipients who access secrets through a SharePass link, without requiring a SharePass account.
\nThis documentation focuses on the API itself and on how to integrate with it programmatically. If you would like to learn more about SharePass, how it works, and the concepts behind secure secret sharing, please visit the knowledge base.
\nWe hope this documentation helps you build secure, flexible, and efficient integrations. Remember, Don't Risk it, SharePass it!
\n","schema":"https://schema.getpostman.com/json/collection/v2.0.0/collection.json","toc":[],"owner":"24259919","collectionId":"f69e59aa-d62f-4a75-b1ae-7017095b639e","publishedId":"2s8YYEPQch","public":true,"customColor":{"top-bar":"FFFFFF","right-sidebar":"303030","highlight":"007BFF"},"publishDate":"2022-11-05T07:08:03.000Z"},"item":[{"name":"Secret","item":[{"name":"View","item":[{"name":"Get Secret","id":"a815faad-6a1c-4af2-b513-2731372e27d4","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"noauth","isInherited":false},"method":"GET","header":[{"key":"pin","value":"{{pin}}","type":"text"}],"url":"{{baseURL}}/{{version}}/secret/view?secretId={{secretId}}","description":"Retrieves a secret for display to the recipient.
\nThis endpoint is intended for the external recipient who receives the SharePass link. The response contains the encrypted secret data, which must be decrypted by the frontend application using the appropriate decryption key.
\nNORequired URL Params:
secretId=[string]
Optional Header Params:
pin=[integer]
This path provides the endpoint used by SharePass recipients to retrieve a secret from a shared view link.
\nA typical SharePass link looks like this:
\nhttps://view.sharepass.com/6jE81B8xv8oMrns/#/pxEZW2F5i7p21uA/lSycG0akwEu4S2cL0Ayf4nDrkDFMWvTFO5bzDhAVsaU
The endpoint is designed for public secret access and does not require the recipient to be a SharePass user. Whether the secret can actually be revealed depends on the access conditions configured by the sender, such as TTL, availability window, IP restrictions, PIN protection, and other security settings applied when the secret was created.
\n","_postman_id":"81364e8d-0328-4d84-8042-b29efa178b65"}],"id":"b08bc8d8-1918-4223-a155-f84931406921","description":"Secrets in SharePass are intended to store highly sensitive and confidential information that needs to be shared securely.
\nDepending on the use case, a secret can represent a simple value such as a password, a longer free-text message, or a more structured object containing multiple pieces of information. In addition to the secret content itself, SharePass supports a range of optional properties that allow the sender to control how, when, and under which conditions the secret can be accessed by the recipient.
\nSharePass supports different secret types depending on the kind of information being shared:
\npassword: A single-line password or short confidential value.
\nmessage: A multiline confidential message.
\ncredentials: A structured object that can contain values such as username, password, 2FA, and URL.
\nQR: A QR-based secret format.
\ncustom: A custom object containing any valid JSON structure.
\nSecrets can also include additional properties that define their behavior and access conditions:
\notl: One Time Link. When enabled, the secret is destroyed after it is successfully retrieved.
\nttl: Time To Live. Defines how long the secret remains available before it expires.
\ndescription: Allows the sender to store additional information about the secret, including private and public descriptions.
\nipList: Restricts access to the secret so it can only be revealed from specific IP addresses.
\navailableFrom: Defines the point in time from which the secret becomes accessible. This value uses epoch time.
\nlockedByOwner: Allows the sender to lock the secret, preventing access until it is unlocked again.
\npin: Adds PIN protection to the secret. The recipient must provide the correct PIN before the secret can be revealed.
\nReturns the details of a specific secret belonging to the authenticated user.
\nYESYESsecretId=[string]Searches for secrets that match the specified criteria for the authenticated user.
\nWhen multiple attributes are provided, the conditions are combined using a logical AND operator.
\nNote: If too many secrets match the criteria, the response may include an ExclusiveStartKey value. To retrieve the next page of results, perform another request using that value as exclusiveStartId.
purpose: A string that indicates the purpose of the secret
\notl: A boolean that matches the OTL value
type: A string that matches the secrets type value
privateDescription: Any string that is contained in the privateDescription value
publicDescription: Any string that is contained in the publicDescription attribute
lockedByOwner: A boolean that matches the lockedByOwner attribute
label: An object that matches the codeName AND/OR the color attribute
pin: A boolean if the secret contains a pin (static or dynamic) in the pin attribute
asc: A boolean that sorts the list ascending or descending by creation attribute
exclusiveStartId: A valid secretID that indicates where the search should begin
expired: A boolean that indicates the secrets that have the expiry value already expired
ipList: A boolean if the secret contains at least one IP address restriction in the ipList attribute
opened: A boolean that matches the secrets opened attribute
YESYES{\n \"purpose\": [string], // Required\n \"otl\": [boolean], // Optional\n \"type\": [string], // Optional\n \"privateDescription\": [string], // Optional\n \"publicDescription\": [string], // Optional\n \"lockedByOwner\": [boolean], // Optional\n \"label\": [object] // Optional\n {\n \"codeName\": [string], // Optional\n \"color\": [string] // Optional\n } \n \"pin\": [boolean], // Optional\n \"asc\": [boolean], // Optional\n \"exclusiveStartId\": [string], // Optional\n \"expired\": [boolean], // Optional\n \"ipList\": [boolean], // Optional\n \"opened\": [boolean], // Optional\n}\n\nExplanation: List all secrets with type PIN with a label color #aaaaaa
\n{\n \"purpose\": \"send\",\n \"type\": \"pin\",\n \"label\": {\"color\": \"#aaaaaa\"}\n}\n\nExplanation: List all expired secrets with type Password that contains a john@contoso.com in the private description
\n{\n \"type\": \"password\",\n \"privateDescription\": \"john@contoso.com\",\n \"expired\": true\n}\n\nExplanation: List all secrets sorted from the oldest to the newest, starting from a specific secretID, pinned protected, and Password type
\n{\n \"type\": \"password\",\n \"pin\": true,\n \"asc\": true,\n \"exclusiveStartId\": \"6s4TeGt1hUbi4PT6NiO5syCtDUicyh\"\n}\n\nThis resource contains the tools that the user need to search for a specific secret previously created or secrets that match certain criteria.
\n","_postman_id":"1d4f9d7f-66d3-45c5-ac68-bf04c65e6eba","auth":{"type":"noauth","isInherited":true,"source":{"_postman_id":"993a411f-7f24-44ba-929e-e1a817ec9d5b","id":"993a411f-7f24-44ba-929e-e1a817ec9d5b","name":"User","type":"folder"}}},{"name":"Update","item":[{"name":"Pin","item":[{"name":"Update Pin Attempts Remaining","id":"2045d836-bfca-4ebb-9e26-2ed28cc77995","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"noauth","isInherited":false},"method":"POST","header":[{"key":"Auth","value":"{{access_token}}","type":"text"}],"body":{"mode":"raw","raw":"{\r\n \"secretId\": \"{{secretId}}\",\r\n \"attemptsRemaining\": 1\r\n}","options":{"raw":{"language":"json"}}},"url":"{{baseURL}}/{{version}}/secret/mysecrets/update/pin","urlObject":{"path":["{{version}}","secret","mysecrets","update","pin"],"host":["{{baseURL}}"],"query":[],"variable":[]}},"response":[{"id":"d7bf1295-50e5-40d1-b145-fcfbb7708a20","name":"Pin Attempts Updated Successfully","originalRequest":{"method":"POST","header":[{"key":"Auth","value":"{{access_token}}","type":"text"}],"body":{"mode":"raw","raw":"{\r\n \"secretId\": \"{{secretId}}\",\r\n \"attemptsRemaining\": 1\r\n}","options":{"raw":{"language":"json"}}},"url":"{{baseURL}}/{{version}}/secret/mysecrets/update/pin"},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Date","value":"Tue, 28 Dec 2021 01:18:05 GMT"},{"key":"Content-Type","value":"application/json"},{"key":"Content-Length","value":"77"},{"key":"Connection","value":"keep-alive"},{"key":"x-amzn-RequestId","value":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"},{"key":"Access-Control-Allow-Origin","value":"*"},{"key":"x-amz-apigw-id","value":"LCTX4Et4SwMFRdw="},{"key":"X-Amzn-Trace-Id","value":"Root=1-61ca65cb-4a22067507bf2a3077c614c1;Sampled=0"}],"cookie":[],"responseTime":null,"body":"{\n \"status\": \"Success\",\n \"message\": \"PIN attempts remaining updated successfully.\"\n}"},{"id":"404374c7-ea5b-442a-a8cb-e2e429b39a2b","name":"Secret Does Not Have PIN Protection","originalRequest":{"method":"POST","header":[{"key":"Auth","value":"{{access_token}}","type":"text"}],"body":{"mode":"raw","raw":"{\r\n \"secretId\": \"{{secretId}}\",\r\n \"attemptsRemaining\": 1\r\n}","options":{"raw":{"language":"json"}}},"url":"{{baseURL}}/{{version}}/secret/mysecrets/update/pin"},"status":"Forbidden","code":403,"_postman_previewlanguage":"json","header":[{"key":"Date","value":"Tue, 28 Dec 2021 01:35:50 GMT"},{"key":"Content-Type","value":"application/json"},{"key":"Content-Length","value":"97"},{"key":"Connection","value":"keep-alive"},{"key":"x-amzn-RequestId","value":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"},{"key":"x-amz-apigw-id","value":"LCV-VG9zywMFVfA="},{"key":"X-Amzn-Trace-Id","value":"Root=1-61ca69f5-470e02d06c8eafea2c0ab32f;Sampled=0"}],"cookie":[],"responseTime":null,"body":"{\n \"status\": \"Forbidden\",\n \"message\": \"Secret ID provided does not have an associated PIN protection.\"\n}"}],"_postman_id":"2045d836-bfca-4ebb-9e26-2ed28cc77995"}],"id":"a62be462-0caf-4a9d-b238-657c9a47ba39","description":"Whenever the attempts to unlock a secret protected by a PIN are exhausted, the owner of the secret can grant more attempts with this endpoint.
\nYES{\n \"secretId\": [string], // Required\n \"attemptsRemaining\": [integer] // Required\n}\n\n{\n \"secretId\": \"fFEiGF8a64CX6xvLt9KR7ZVzXbvzQJ\", // Required\n \"attemptsRemaining\": 3\n}\n\nUpdates an existing secret.
\nOnly the owner (creator) of the secret can modify it.
\nNote: To remove a supported attribute, assign it the value null.
YESYES{\n \"secretId\": [string], // Required\n \"updateAttributes\": [object], // Required\n { \n \"eraseSecret\": [boolean] // Optional\n \"lockedByOwner\": [boolean] or [null], // Optional\n \"publicDescription\": [string] or [null], // Optional\n \"privateDescription\": [string] or [null], // Optional\n \"label\": [object] or [null] // Optional\n {\n \"codeName\": [string], // Required\n \"color\": [string] // Required\n },\n \"ipList\": [array] or [null], // Optional\n \"pin\": [object] or [null] // Optional (1 property min/max)\n { \n \"static\": [string], // Optional\n \"dynamic\": [string] // Optional\n },\n \"ttl\": [object] // Optional (1 property min/max)\n {\n \"relative\": [integer], // Optional\n \"absolute\": [integer] // Optional\n },\n \"availableFrom\": [object] // Optional (1 property min/max)\n {\n \"relative\": [integer], // Optional\n \"absolute\": [integer] // Optional\n }\n }\n}\n\n{\n \"secretId\": \"E5OeK1KBuZFxyKQNlLggLBsW1MnWUp\",\n \"updateAttributes\":{\n \"lockedByOwner\": true,\n \"publicDescription\": \"Some public description here.\",\n \"privateDescription\": \"Some public description here.\",\n \"label\": {\n \"codeName\": \"SharePass\",\n \"color\": \"#ffabe2\"\n }\n }\n}\n\nThis resource contains the methods to update secret attributes.
\n","_postman_id":"1f7efe0d-4ae4-4a17-af26-cb62f19e496d","auth":{"type":"noauth","isInherited":true,"source":{"_postman_id":"993a411f-7f24-44ba-929e-e1a817ec9d5b","id":"993a411f-7f24-44ba-929e-e1a817ec9d5b","name":"User","type":"folder"}}},{"name":"Default","item":[{"name":"Creates Authenticated Secret (default template)","id":"c53ea78b-4b86-4545-ba79-13bd17e5bd43","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"noauth","isInherited":false},"method":"POST","header":[{"key":"Auth","value":"{{access_token}}","type":"text"}],"body":{"mode":"raw","raw":"{\r\n \"secret\": \"Some Secret Encrypted Message\",\r\n \"type\": \"message\"\r\n}","options":{"raw":{"language":"json"}}},"url":"{{baseURL}}/{{version}}/secret/mysecrets/default","description":"Used to create a new secret using the default template. This endpoint behaves exactly like the main endpoint, except that only accepts secret and type attributes.
\nYES{\n \"secret\": [string], // Required\n \"type\": [string] // Required\n}\n\n{\n \"secret\": \"Some Secret Encrypted Message.\",\n \"type\": \"message\"\n}\n\nThe default resource refers to the secrets created using the default template.
\n","_postman_id":"c0631fb1-27db-42fb-9adb-62911c93f59e","auth":{"type":"noauth","isInherited":true,"source":{"_postman_id":"993a411f-7f24-44ba-929e-e1a817ec9d5b","id":"993a411f-7f24-44ba-929e-e1a817ec9d5b","name":"User","type":"folder"}}},{"name":"Template","item":[{"name":"Creates Authenticated Secret (by template)","id":"b36037c5-5d5e-44d4-8326-57388ff6e689","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"noauth","isInherited":false},"method":"POST","header":[{"key":"Auth","value":"{{access_token}}","type":"text"}],"body":{"mode":"raw","raw":"{\r\n \"secret\": \"Some Secret Encrypted Message\",\r\n \"type\": \"message\",\r\n \"templateCodeName\": \"123\"\r\n}","options":{"raw":{"language":"json"}}},"url":"{{baseURL}}/{{version}}/secret/mysecrets/template","description":"Creates a new secret using a specific template.
\nThis endpoint is a simplified version of the main secret creation endpoint. It is intended for cases where the secret settings are predefined in a template, so the request only needs to provide the secret content, its type, and the templateCodeName.
Like the main secret creation endpoint, the secret value is expected to be encrypted before the request is sent.
Important: If the client wants SharePass to perform the encryption, the request must include the X-SharePass-Input: plaintext header. When this header is provided, the backend encrypts the plaintext secret before creating it.
YESYES{\n \"secret\": [string], // Required\n \"type\": [string], // Required\n \"templateCodeName\": [string] // Required\n}\n\n{\n \"secret\": \"Some Secret Encrypted Message.\",\n \"type\": \"message\",\n \"templateCodeName\": \"Test template\"\n}\n\nThis path provides the endpoint to create a secret using a predefined template.
\nIt is intended to simplify secret creation when the secret configuration has already been defined in a template.
\n","_postman_id":"ec146faa-00f7-4fa4-b136-4f0eabfacdc0","auth":{"type":"noauth","isInherited":true,"source":{"_postman_id":"993a411f-7f24-44ba-929e-e1a817ec9d5b","id":"993a411f-7f24-44ba-929e-e1a817ec9d5b","name":"User","type":"folder"}}},{"name":"Creates Authenticated Secret","id":"ae87ffa7-c513-4024-973d-ec4f0cbcd114","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"noauth","isInherited":false},"method":"POST","header":[{"key":"Auth","value":"{{access_token}}","type":"text"},{"key":"X-SharePass-Input","value":"plaintext","type":"text"}],"body":{"mode":"raw","raw":"{\r\n \"secret\": \"Some Secret Encrypted Message\",\r\n \"otl\": false,\r\n \"ttl\": {\"relative\": 60000},\r\n \"type\": \"message\",\r\n \"privateDescription\": \"YEEEESSS!!!\",\r\n \"publicDescription\": \"test test test\",\r\n \"lockedByOwner\": false,\r\n \"emailVerificationList\": [\"megchisp@hotmail.com\",\"megchisp@gmail.com\",\"mauro@sharepass.com\"]\r\n}","options":{"raw":{"language":"json"}}},"url":"{{baseURL}}/{{version}}/secret/mysecrets","description":"Creates a new secret to share data securely.
\nThis is the main endpoint used to share data through SharePass. It allows the authenticated user to create a secret with optional restrictions and metadata, such as expiration rules, availability time, IP restrictions, PIN protection, labels, and descriptions.
\nBy default, the secret value must already be encrypted by the sender before calling this endpoint.
Important: If the client interacts directly with the backend and wants SharePass to perform the encryption, the request must include the X-SharePass-Input: plaintext header. When this header is provided, the backend encrypts the plaintext secret and returns both the decryption key and the view link.
YESYEStemplateCodeName=[string]X-SharePass-Input=plaintext{\n \"secret\": [string], // Required\n \"otl\": [boolean], // Required\n \"type\": [string], // Required\n \"ttl\": [object] // Optional (1 property min/max)\n {\n \"relative\": [integer], // Optional\n \"absolute\": [integer] // Optional\n },\n \"availableFrom\": [object] // Optional (1 property min/max)\n {\n \"relative\": [integer], // Optional\n \"absolute\": [integer] // Optional\n }\n \"ipList\": [array], // Optional\n \"lockAfterUse\": [boolean], // Optional\n \"privateDescription\": [string], // Optional\n \"publicDescription\": [string], // Optional\n \"lockedByOwner\": [boolean], // Optional \n \"pin\": [object] or [null] // Optional (1 property min/max)\n { \n \"static\": [string], // Optional\n \"dynamic\": [string] // Optional\n },\n \"label\": [object] // Optional\n {\n \"codeName\": [string], // Required\n \"color\": [string] // Required\n } \n}\n\n{\n \"secret\": \"Some Secret Encrypted Message.\",\n \"otl\": false,\n \"ttl\": {\"absolute\": 1618498005},\n \"availableFrom\": {\"relative\": 6000},\n \"type\": \"message\",\n \"ipList\": [\"1.1.1.1\",\"2.2.2.2\",\"3.3.3.3\"],\n \"privateDescription\": \"private secret number 1\",\n \"publicDescription\": \"public secret number 1\",\n \"lockedByOwner\": false,\n \"pin\": {\"static\": \"456789\"},\n \"label\": {\"codeName\": \"my label 123\", \"color\": \"#aaaaaa\"}\n}\n\n{\n \"secret\": \"Some Secret Encrypted Message.\",\n \"otl\": false,\n \"ttl\": {\"relative\": 6000},\n \"availableFrom\": {\"absolute\": 1618498005},\n \"type\": \"message\",\n \"ipList\": [\"1.1.1.1\",\"2.2.2.2\",\"3.3.3.3\"],\n \"privateDescription\": \"private secret number 2\",\n \"publicDescription\": \"public secret number 2\",\n \"lockedByOwner\": false,\n \"pin\": {\"dynamic\": \"jmsqk5vwvz7klmb6pyx3p4h7ek2daqt6\"}\n}\n\nPermanently deletes a secret from SharePass.
\nThis is a hard delete operation. It removes the entire secret record from the database, including its settings and access logs. Once deleted, the secretId is also removed and the secret cannot be recovered.
Note: If the authenticated user is not the owner of the secret, the endpoint returns a 404 - Not Found error.
Caution: Deleted secrets cannot be recovered.
\nYESYES{\n \"secretId\": [string] // Required\n}\n\n{\n \"secretId\": \"bKJ8VseNK533YkejWaA8E2I23Z8s3j\"\n}\n\nAuthenticated users can make use of 'My secrets' menu. From it, the user is able to track the history of all their secrets created and also perform some management (such as update and delete).
\n","event":[{"listen":"prerequest","script":{"type":"text/javascript","exec":[""],"id":"72ba5794-bb4d-415b-9b7f-b00c7b097f50"}},{"listen":"test","script":{"type":"text/javascript","exec":[""],"id":"8535f1eb-11d1-4dfc-b1d0-0783b79200e9"}}],"_postman_id":"c7365e88-c3b9-4d61-af85-101b5bfbcc0f","auth":{"type":"noauth","isInherited":true,"source":{"_postman_id":"993a411f-7f24-44ba-929e-e1a817ec9d5b","id":"993a411f-7f24-44ba-929e-e1a817ec9d5b","name":"User","type":"folder"}}},{"name":"Settings","item":[{"name":"Webhooks","item":[{"name":"Set Webhook","id":"260b4fd1-2ba5-48fe-a27d-a86cd5994f80","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"noauth","isInherited":false},"method":"PUT","header":[{"key":"Auth","value":"{{access_token}}","type":"text"}],"body":{"mode":"raw","raw":"{\r\n \"active\" : true,\r\n \"url\": \"https://example.com/somepath\",\r\n \"secretToken\": \"Some Secret Token Here\"\r\n}","options":{"raw":{"language":"json"}}},"url":"{{baseURL}}/{{version}}/user/settings/webhooks","description":"Used to create or edit existing webhook settings. It is important to remark that if there is a webhook already configured, the call to this endpoint will overwrite the existing one.
\nYES{\n \"active\" : [boolean], // Required\n \"url\": [string], // Required\n \"secretToken\": [string] // Optional\n}\n\n{\n \"active\" : true,\n \"url\": \"https://example.com/somepath\",\n \"secretToken\": \"Some Secret Token Here\"\n}\n\nUsed to delete user's webhook settings.
\nYESNoneThis path provides endpoints to create, update, enable, disable, and delete webhooks.
\n","auth":{"type":"noauth","isInherited":false},"event":[{"listen":"prerequest","script":{"type":"text/javascript","exec":[""],"id":"4bafaa6a-83ee-466c-a613-15960544071c"}},{"listen":"test","script":{"type":"text/javascript","exec":[""],"id":"f07d907a-7b4a-410d-ade0-e368e63fcc4c"}}],"_postman_id":"26c26238-b610-454e-a64e-56106394a784"},{"name":"Secret Template","item":[{"name":"My Templates","item":[{"name":"Get All Templates","id":"58d47e05-021f-45b1-9f38-146c06827642","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"noauth","isInherited":false},"method":"GET","header":[{"key":"Auth","value":"{{access_token}}","type":"text"}],"url":"{{baseURL}}/{{version}}/user/settings/secrettemplate/mytemplates","description":"Retrieves all templates created by the authenticated user.
\nThe response includes the codeName and starred attributes for each template.
YESYESNoneThis path provides the endpoint to list the existing secret templates.
\nThe response returns the available templates for the authenticated user, including basic information such as codeName and starred.
Updates the default template replacing all previous settings.
\nYES{\n \"otl\": [boolean], // Required\n \"type\": [string], // Required\n \"ipList\": [array], // Optional\n \"privateDescription\": [string], // Optional\n \"publicDescription\": [string], // Optional\n \"lockedByOwner\": boolean, // Optional (false if not specified)\n \"ttl\": [object] // Required (1 property min/max)\n {\n \"relative\": [integer], // Optional\n \"absolute\": [integer] // Optional\n },\n \"availableFrom\": [object] // Optional (1 property min/max)\n {\n \"relative\": [integer], // Optional\n \"absolute\": [integer] // Optional\n }\n \"pin\": [object] or [null] // Optional (1 property min/max)\n { \n \"static\": [string], // Optional\n \"dynamic\": [string] // Optional\n },\n \"label\": [object] // Optional\n {\n \"codeName\": [string], // Required\n \"color\": [string] // Required\n } \n \n}\n\n {\n \"otl\": true,\n \"ttl\": {\"absolute\": 1618498005},\n \"availableFrom\": {\"relative\": 600},\n \"type\": \"password\",\n \"ipList\": [\"1.1.1.1\"],\n \"privateDescription\": \"Private description\",\n \"publicDescription\": \"Public description\",\n \"lockedByOwner\": true,\n \"pin\": {\"static\": \"123456\"},\n \"label\": {\"codeName\": \"SharePass\", \"color\": \"#8a2be2\"}\n}\n\nRetrieve the default template with all its settings. Returns null value for a template that was never updated.
\nYESNoneThe default template defines the initial security settings when creating a new secret.
\n","_postman_id":"eb2d88ec-0eab-4ae0-ab29-ccc95e06cd98","auth":{"type":"noauth","isInherited":true,"source":{"_postman_id":"4da2bd4e-a9bf-46fc-b9e2-086d5c40adbe","id":"4da2bd4e-a9bf-46fc-b9e2-086d5c40adbe","name":"Settings","type":"folder"}}},{"name":"Create Template","id":"1394c795-adcc-458d-8d31-a6c1a813f095","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"noauth","isInherited":false},"method":"POST","header":[{"key":"Auth","value":"{{access_token}}","type":"text"}],"body":{"mode":"raw","raw":" {\r\n \"codeName\": \"My 1st template\",\r\n \"starred\" : false,\r\n \"details\" :{\r\n \"otl\": false,\r\n \"ttl\": {\"absolute\": 1618498005},\r\n \"availableFrom\": {\"relative\": 600},\r\n \"ipList\": [\"1.1.1.1\",\"2.2.2.2\",\"3.3.3.3\"],\r\n \"privateDescription\": \"Private description\",\r\n \"publicDescription\": \"Public description\",\r\n \"lockedByOwner\": false,\r\n \"lockAfterUse\": true,\r\n \"pin\": {\"dynamic\": \"jmsqk5vwvz7klmb6pyx3p4h7ek2daqt6\"},\r\n \"label\": {\"codeName\": \"SharePass\", \"color\": \"#8a2be2\"}\r\n }\r\n}","options":{"raw":{"language":"json"}}},"url":"{{baseURL}}/{{version}}/user/settings/secrettemplate","description":"Used to create a new secret template. Templates use the codeName attribute as an ID, so it cannot be changed after its creation.
\nNote: There is a limit of 250 templates.
\nYES{\n \"codeName\": [string], // Required\n \"starred\": [boolean], // Optional (false if not specified)\n \"details\": {\n \"otl\": [boolean], // Required\n \"ipList\": [array], // Optional\n \"privateDescription\": [string], // Optional\n \"publicDescription\": [string], // Optional\n \"lockedByOwner\": [boolean], // Optional (false if not specified)\n \"ttl\": [object] // Required (1 property min/max)\n {\n \"relative\": [integer], // Optional\n \"absolute\": [integer] // Optional\n },\n \"availableFrom\": [object] // Optional (1 property min/max)\n {\n \"relative\": [integer], // Optional\n \"absolute\": [integer] // Optional\n }\n \"pin\": [object] or [null] // Optional (1 property min/max)\n { \n \"static\": [string], // Optional\n \"dynamic\": [string] // Optional\n },\n \"label\": [object] // Optional\n {\n \"codeName\": [string], // Required\n \"color\": [string] // Required\n } \n }\n}\n\n {\n \"codeName\": \"My 1st template\",\n \"starred\": true,\n \"details\" : {\n \"otl\": false,\n \"ttl\": {\"absolute\": 1618498005},\n \"availableFrom\": {\"relative\": 600},\n \"type\": \"message\",\n \"ipList\": [\"1.1.1.1\",\"2.2.2.2\",\"3.3.3.3\"],\n \"privateDescription\": \"Private description\",\n \"publicDescription\": \"Public description\",\n \"lockedByOwner\": false,\n \"pin\": {\"dynamic\": \"jmsqk5vwvz7klmb6pyx3p4h7ek2daqt6\"},\n \"label\": {\"codeName\": \"SharePass\", \"color\": \"#8a2be2\"}\n }\n}\n\nUsed to update existing templates. When attempting to edit a template with codeName that does not exist, an error 403 - Forbidden will be returned.
\nYES{\n \"codeName\": [string], // Required\n \"updateAttributes\": [Object] // Required\n {\n \"starred\": [boolean], // Optional (false if not specified)\n \"details\": [Object] // Optional\n {\n \"otl\": [boolean], // Required\n \"type\": [string], // Required\n \"ipList\": [array], // Optional\n \"privateDescription\": [string], // Optional\n \"publicDescription\": [string], // Optional\n \"lockedByOwner\": boolean, // Optional (false if not specified)\n \"ttl\": [object] // Required (1 property min/max)\n {\n \"relative\": [integer], // Optional\n \"absolute\": [integer] // Optional\n },\n \"availableFrom\": [object] // Optional (1 property min/max)\n {\n \"relative\": [integer], // Optional\n \"absolute\": [integer] // Optional\n }\n \"pin\": [object] or [null] // Optional (1 property min/max)\n { \n \"static\": [string], // Optional\n \"dynamic\": [string] // Optional\n },\n \"label\": [object] // Optional\n {\n \"codeName\": [string], // Required\n \"color\": [string] // Required\n } \n }\n }\n}\n\n {\n \"codeName\": \"My 2nd template\",\n \"updateAttributes\": {\n \"starred\": false,\n \"details\" : {\n \"otl\": true,\n \"ttl\": {\"absolute\": 1618498005},\n \"availableFrom\": {\"relative\": 600},\n \"type\": \"password\",\n \"ipList\": [\"1.1.1.1\"],\n \"privateDescription\": \"Private description\",\n \"publicDescription\": \"Public description\",\n \"lockedByOwner\": true,\n \"pin\": {\"static\": \"123456\"},\n \"label\": {\"codeName\": \"SharePass\", \"color\": \"#8a2be2\"}\n }\n }\n}\n\nMake use of this method to delete an existing template. If the codeName provided is non-existent an 403 - Forbidden error will be returned.
\nYES{\n \"codeName\": [string] // Required\n}\n\n{\n \"codeName\": \"My 1st template\"\n}\n\nUsed to retrieve details from a specific template given an existent codeName.
\nYEScodeName=[string]Templates are useful when the user requires to send recurrent secrets with the same privacy settings (visibility, availability, accessibility & authorization).
\nThis endpoint contains operations for templates destined for sending secrets.
\n","_postman_id":"1e143384-373e-4edb-ab4b-f919be497987","auth":{"type":"noauth","isInherited":true,"source":{"_postman_id":"4da2bd4e-a9bf-46fc-b9e2-086d5c40adbe","id":"4da2bd4e-a9bf-46fc-b9e2-086d5c40adbe","name":"Settings","type":"folder"}}},{"name":"Label","item":[{"name":"Create Label","id":"d768962b-0322-4ba0-9988-eb881da6fe16","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[{"key":"Auth","value":"{{access_token}}","type":"text"}],"body":{"mode":"raw","raw":"{\r\n \"codeName\": \"My label\",\r\n \"color\": \"#ffffff\"\r\n}","options":{"raw":{"language":"json"}}},"url":"{{baseURL}}/{{version}}/user/settings/label","description":"Creates a new label for the authenticated user.
\nLabels can later be attached to secrets to help organize and classify them.
\nYES{\n \"codeName\": [string], // Required\n \"color\": [string] // Required\n}\n\n{\n \"codeName\": \"My label\",\n \"color\": \"#aaaaaa\"\n}\n\nDeletes an existing label identified by its codeName.
Deleting a label does not remove it from secrets where it was previously attached. Existing secret-label associations remain unchanged.
\nYES{\n \"codeName\": \"[ \"Name of the label\" ] // Required\n}\n\n{\n \"codeName\": \"My label\"\n}\n\nRetrieves all labels created by the authenticated user.
\nYESYESNoneIn SharePass, labels allow users to categorize secrets for better organization and filtering.
\nThis resource supports creating, retrieving, and deleting labels.
\n","_postman_id":"52b11382-0e4f-47b1-8a95-efc882eba844","auth":{"type":"noauth","isInherited":true,"source":{"_postman_id":"4da2bd4e-a9bf-46fc-b9e2-086d5c40adbe","id":"4da2bd4e-a9bf-46fc-b9e2-086d5c40adbe","name":"Settings","type":"folder"}}},{"name":"Welcome Screen","item":[{"name":"Set Welcome Screen","id":"779cbb56-b7c3-482c-bc7b-37283259ee63","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"noauth","isInherited":false},"method":"PUT","header":[{"key":"Auth","value":"{{access_token}}","type":"text"}],"body":{"mode":"raw","raw":"{\r\n \"welcomeScreen\": false\r\n}","options":{"raw":{"language":"json"}}},"url":"{{baseURL}}/{{version}}/user/settings/welcomescreen","description":"Used to enable/disable the welcome screen. This welcome screen is enabled by default for all newly created users.
\nYES{\n \"welcomeScreen\" : [boolean] // Required\n}\n\n{\n \"welcomeScreen\" : true\n}\n\nReturns a unique generated shared secret key code for the user account.
\nNote: Calling this endpoint immediately disassociates the existing software token from the user account. If the user doesn't subsequently verify the token (6 digit code), their account is essentially set up to authenticate without MFA.
\nYESNoneThis endpoint returns the status of the MFA. It basically can be enabled or disabled which is represented by a boolean. For privacy, this endpoint requires the users to confirm their passwords. Optionally, a friendly authenticator name can be returned if the MFA is enabled.
\nYES{\n \"password\": [string] // Required\n}\n\n{\n \"password\": \"Abcd1234!@#$\"\n}\n\nAt the moment this endpoint only enables or disables MFA. Needs to be remarked, this endpoint will work only if the current MFA token (also known as code) has been validated. In the future, multiple MFA methods will be allowed so users can select their preference.
\nThis endpoint returns the status of the MFA. It basically can be enabled or disabled which is represented by a boolean. For privacy, this endpoint requires the users to confirm their passwords. Optionally, a friendly authenticator name can be returned if the MFA is enabled.
\nYES\n{\n \"enabled\": [boolean] // Required\n}\n\n\n{\n \"enabled\": true\n}\n\nUse this API to verify the user's MFA and mark the user's token MFA status as \"verified\" if successful.
\nYES{\n \"userCode\": [string], // Required\n \"friendlyDeviceName\": [string] // Optional\n}\n\n{\n \"userCode\": \"123456\",\n \"friendlyDeviceName\": \"Google Authenticator\"\n}\n\nMulti-factor authentication (MFA) is a security measure that requires two proofs of identity to grant access to the account. The first proof is the mandatory username/password combination and the second one is a secret code.
\n","_postman_id":"c308f81f-5883-4123-9608-66fa98355bba","auth":{"type":"noauth","isInherited":true,"source":{"_postman_id":"4da2bd4e-a9bf-46fc-b9e2-086d5c40adbe","id":"4da2bd4e-a9bf-46fc-b9e2-086d5c40adbe","name":"Settings","type":"folder"}}},{"name":"MFA Security keys","item":[{"name":"Public key request","event":[{"listen":"test","script":{"id":"f126f875-d162-4316-80ab-da28f3d6cd6e","exec":[""],"type":"text/javascript"}}],"id":"a0ade488-6362-4146-a094-d7b4ae624422","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[{"key":"Auth","value":"{{access_token}}","type":"text"}],"url":"{{baseURL}}/{{version}}/webauthn/create","description":"Returns the data required to register a new WebAuthn authenticator.
\nThis endpoint generates the credential creation options needed to create a key pair on the user's authenticator device. The returned values, including user.id, challenge, and any excludeCredentials[].id, are Base64-encoded and must be decoded before being passed to the WebAuthn API.
These values are typically used in a frontend application when calling navigator.credentials.create().
YESNone// This will do the API request\nconst {\n status,\n details,\n message,\n redirect\n} = await fetchWebauthnCreate();\nif (redirect) {\n dispatch({\n type: types.logout,\n });\n history.push(\"/auth/login\");\n} else if (status === \"Success\") {\n let credOptions = details;\n let challenge = credOptions.challenge;\n credOptions.user.id = b64decode(credOptions.user.id);\n credOptions.challenge = b64decode(credOptions.challenge);\n if (credOptions.excludeCredentials) {\n for (\n let i = 0,\n size = credOptions.excludeCredentials.length;\n i < size;\n i++\n ) {\n credOptions.excludeCredentials[i].id = b64decode(\n credOptions.excludeCredentials[i].id\n );\n }\n }\n // Create credentials using the available authenticator\n const cred = await navigator.credentials\n .create({\n publicKey: credOptions,\n })\n .catch(function(error) {\n throw error;\n });\n}\n\nRegisters a new security key for multi-factor authentication (MFA) on the authenticated user's account.
\nThis endpoint is used after the Public key request endpoint. Once the frontend obtains the credential from the authenticator using navigator.credentials.create(), the returned values must be processed and sent to this endpoint to complete the registration of the new security key.
YES{\n \"keyName\": \"string\", // Required\n \"id\": \"string\", // Required\n \"rawId\": \"string\", // Required (Base64-encoded)\n \"type\": \"string\", // Required\n \"challenge\": \"string\", // Required\n \"response\": { // Required\n \"clientDataJSON\": \"string\", // Required (Base64-encoded)\n \"attestationObject\": \"string\" // Required (Base64-encoded)\n },\n \"transports\": \"string\" // Optional\n}\n\nconst cred = await navigator.credentials.create({publicKey: credOptions});\n\nthe obtained values should be processed and sent to this endpoint.
\nlet endData: any = {\n keyName: values.keyName,\n};\nconst credential: {\n id ? : any;\n rawId ? : any;\n type ? : any;\n challenge ? : any;\n response ? : any;\n transports ? : any;\n} = {};\ncredential.id =\n cred && cred.id ? cred.id : null;\ncredential.rawId = b64encode(\n cred && cred.rawId ? cred.rawId : null\n);\ncredential.type =\n cred && cred.type ? cred.type : null;\ncredential.challenge = challenge;\nif (cred && cred.response) {\n const clientDataJSON = b64encode(\n cred.response.clientDataJSON\n );\n const attestationObject = b64encode(\n cred.response.attestationObject\n );\n credential.response = {\n clientDataJSON,\n attestationObject,\n };\n credential.transports = JSON.stringify(\n cred.response.getTransports()\n );\n}\nendData = {\n ...endData,\n ...credential\n};\n//this function will do the API Call\nconst parseResult =\n await fetchWebauthnParseAdd(endData);\n\nDeletes an existing MFA security key from the authenticated user's account.
\nThe request must include the security key id in the request body.
YES{\n \"id\": \"string\" // Required\n}\n\nThis group of endpoints will allow a user to have security keys configured for MFA.
\nIMPORTANT! ONLY AVAILABLE FOR USERS THAT DON'T USE SSO
\n","_postman_id":"5ffdaf41-2540-4635-b414-3bba69b8f87c","auth":{"type":"noauth","isInherited":true,"source":{"_postman_id":"4da2bd4e-a9bf-46fc-b9e2-086d5c40adbe","id":"4da2bd4e-a9bf-46fc-b9e2-086d5c40adbe","name":"Settings","type":"folder"}}},{"name":"Update Settings","id":"b8df6e2c-62e5-4d9f-9908-495f390912ca","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"noauth","isInherited":false},"method":"PUT","header":[{"key":"Auth","value":"{{access_token}}","type":"text"}],"body":{"mode":"raw","raw":"{\r\n \"apiKeyEnabled\": true\r\n}","options":{"raw":{"language":"json"}}},"url":"{{baseURL}}/{{version}}/user/settings","description":"Updates the authenticated user's general settings.
\nThis endpoint is used to manage account-level preferences such as theme and interface messages. It also includes the apiKeyEnabled setting, which controls whether the user's API key is generated and enabled for use on endpoints that support API key authentication.
Because of this, this endpoint is especially important for developers who want to authenticate with SharePass using an API key instead of a JWT on supported endpoints.
\nYES{\n \"lightTheme\": [boolean], // Optional\n \"revealMessage\": [string], // Optional\n \"sendMessage\": [string], // Optional\n \"sidebarToggle\": [string], // Optional\n \"apiKeyEnabled\": [string] // Optional\n}\n\n{\n \"lightTheme\": false,\n \"revealMessage\": \"Click here to reveal\",\n \"sendMessage\": \"Click here to send secret\",\n \"sidebarToggle\": true\n}\n\nThe Settings resource provides operations to manage user configuration and account-level preferences in SharePass.
\nThrough this resource, users can configure features such as webhooks, secret templates, labels, theme preferences, API keys, and multi-factor authentication (MFA), among other account settings.
\n","auth":{"type":"noauth","isInherited":false},"event":[{"listen":"prerequest","script":{"type":"text/javascript","exec":[""],"id":"a407c06a-1b7b-4caa-96c1-3823f15382a8"}},{"listen":"test","script":{"type":"text/javascript","exec":[""],"id":"f9236db4-84e0-4172-a7b4-47c5444ccd69"}}],"_postman_id":"4da2bd4e-a9bf-46fc-b9e2-086d5c40adbe"},{"name":"Sign In","item":[{"name":"Sign In (Basic)","id":"a1b5634b-32d6-4612-9ffc-a1a8376633c8","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"noauth","isInherited":false},"method":"POST","header":[],"body":{"mode":"raw","raw":"{\r\n \"email\": \"{{email}}\",\r\n \"password\": \"{{password}}\"\r\n}","options":{"raw":{"language":"json"}}},"url":"{{baseURL}}/{{version}}/user/signin/","description":"If the account DOES NOT have MFA activated, this endpoint is used to collect the tokens (access_token, refresh_token, and id_token) for a registered user. Oppositely, if the account DOES have MFA activated, the endpoint will return the Session** that will be used to login and a *ChallengeName indicating the type of MFA activated.
\nIf it is required a temporary sessionToken to redirect after successful sign-in, it is necessary to add the mobile header set to true.
\nNote: At the moment only SOFTWARE_TOKEN_MFA (for authenticator MFA with TOTP) and CUSTOM_CHALLENGE (for security key MFA) are returned as the type of ChallengeName, but in the future, there is a possibility of adding more types of MFA methods.
\nNO{\n \"email\": [string], // Required\n \"password\": [string] // Required\n}\n\n{\n \"username\": \"user@contoso.com\",\n \"password\": \"Abcd1234!@#$\"\n}\n\nThis endpoint will return the user session using a temporary sessionToken and the userId. The sessionToken will be valid for 10 seconds after its generation in any of the signin endpoints (MFA, SSO, WebAuthn, and basic). The sessionToken will be returned only if the header mobile is present and set to true in the signin request.
\nNOThis endpoint will be used only if the account configured wit Single Sign On.
\nIf it is required a temporary sessionToken to redirect after successful sign-in, it is necessary to add the mobile header set to true.
\nThe code is returned by the authentication flow with the identity provider and needs to be exchange for the access tokens.
\nThe redirect_uri is the configured URL for redirect after successful sign-in.
\nAnd the verifier is a random word used to generate a code_challenge that is been sent to the identity provider when starting the authentication flow. See example below:
\nconst challenge_from_verifier = async function(v) {\n const hashed = await sha256(v);\n const base64encoded = b64encode(hashed);\n return base64encoded;\n}\n\nconst generateRandomString = () => {\n var array = new Uint32Array(56 / 2);\n window.crypto.getRandomValues(array);\n return Array.from(array, dec2hex).join('');\n}\n\nconst verifier = generateRandomString();\nconst code_challenge = encodeURIComponent(\n await challenge_from_verifier(verifier)\n);\n\n//Stored in localstorage to be available on redirect\nlocalStorage.setItem(\"verifier\", verifier);\n\nwindow.location.assign(\n `${FrontendConfig.auth_url}/oauth2/authorize?identity_provider=${idp}&redirect_uri=${redirect}&response_type=${type}&client_id=${cid}&scope=${scope}&state=${state}&code_challenge=${code_challenge}&code_challenge_method=S256`\n);\n\nNOThis endpoint will be used only if the account is protected with an MFA.
\nIf it is required a temporary sessionToken to redirect after successful sign-in, it is necessary to add the mobile header set to true.
\nNO{\n \"session\": [string], // Required\n \"email\": [string], // Required\n \"mfaCode\": [string] // Required\n}\n\n{\n \"session\": \"xxxxxxxxxxxxxxxx\",\n \"email\": \"user@contoso.com\",\n \"mfaCode\": \"123456\"\n}\n\nThis endpoint needs to be called after sign in returns a CUSTOM_CHALLENGE.
\nIf it is required a temporary sessionToken to redirect after successful sign-in, it is necessary to add the mobile header set to true.
\nThe challenge returned needs to be processed and use to authenticate the user with the security key and validated after with this endpoint. In javascript this could be done in the browser with this API call:
\nnavigator.credentials.get({publicKey: signinOptions});\n\nThe challenge parameters need to be processed before using them as signInOptions. In the following snippet, you can see a pseudo code on how to process this data.
\nif (session && ChallengeName === \"CUSTOM_CHALLENGE\") {\n let challengeAllowedCreds = JSON.parse(\n ChallengeParameters.allowedCredentials\n );\n let allowedCreds = [];\n for (let i = 0, size = challengeAllowedCreds.length; i < size; i++) {\n allowedCreds.push({\n id: b64decode(challengeAllowedCreds[i][\"id\"]),\n type: \"public-key\",\n transports: challengeAllowedCreds[i][\"transports\"],\n });\n }\n //----------get creds from security key or platform authenticator\n const signinOptions = {\n challenge: b64decode(ChallengeParameters.challenge),\n timeout: 1800000,\n rpId: window.location.hostname,\n userVerification: \"discouraged\",\n allowCredentials: allowedCreds,\n };\n //get sign in credentials from authenticator\n const cred = await navigator.credentials.get({\n publicKey: signinOptions,\n });\n //prepare credentials challenge response\n const credential = {};\n if (cred.response) {\n const clientDataJSON = b64encode(cred.response.clientDataJSON);\n const authenticatorData = b64encode(\n cred.response.authenticatorData\n );\n const signature = b64encode(cred.response.signature);\n const userHandle = b64encode(cred.response.userHandle);\n credential.response = {\n clientDataJSON,\n authenticatorData,\n signature,\n userHandle,\n };\n const bodyWebauthn = {\n credId: cred.id,\n session: session,\n authenticatorData: authenticatorData,\n clientDataJSON: clientDataJSON,\n signature: signature,\n username: ChallengeParameters.USERNAME,\n };\n setLoadingWebauthn(true);\n const {\n token,\n expiresIn,\n idToken,\n refreshToken\n } =\n await fetchLoginWebauthn(bodyWebauthn);\n // Fetch profile\n const {\n redirect,\n details\n } = await fetchUserProfile(token);\n setLoadingWebauthn(false);\n setStorageAndRedirect(\n details,\n expiresIn,\n idToken,\n lastPath,\n redirect,\n refreshToken,\n token\n );\n } else {\n throw new Error(\n \"There was an error trying to authenticate you using this key.\"\n );\n }\n}\n\nOnce users has successfully sign up, they will be able to login (or sign in). There are basically 2 types of logins; a Basic authentication (which requires username and password) and another one protected with Multi-factor authentication.
\nMFA or Multi-factor authentication (also well known as 2FA) is an authentication method that requires the user to provide a dynamic code (in addition to the username/password combination) to gain access to a SharePass console.
\n","_postman_id":"07f2d397-3dea-4d74-b5a1-457f37171572","auth":{"type":"noauth","isInherited":true,"source":{"_postman_id":"993a411f-7f24-44ba-929e-e1a817ec9d5b","id":"993a411f-7f24-44ba-929e-e1a817ec9d5b","name":"User","type":"folder"}}},{"name":"Refresh Token","id":"85fcdfe6-9828-4e73-8fb4-dd9cb9ea7b0c","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"noauth","isInherited":false},"method":"POST","header":[],"body":{"mode":"raw","raw":"{\r\n \"refreshToken\": \"{{refresh_token}}\"\r\n}","options":{"raw":{"language":"json"}}},"url":"{{baseURL}}/{{version}}/user/refreshtoken","description":"Used to refresh access_token and id_token. The access_token is essential for user authentication.
\nNO{\n \"refreshToken\": [string] // Required\n}\n\n{\n \"refreshToken\": \"XXXXXXXXXXXXXXXXXXXXXX\"\n}\n\nUsed to revoke the refresh_token provided so access_tokens cannot be created anymore with it. This endpoint can be used to sign out from the current session.
\nYES{\n \"refreshToken\": [string] // Required\n}\n\n{\n \"refreshToken\": \"xxxxxxxxxxxxxxxxxxxx\"\n}\n\nUsed to retrieve profile information about the user.
\nYESNoneUsed to retrieve further profile details about the user.
\nYESNoneUsed to request a password reset. A code verification will be sent (usually via email) after successfully calling this endpoint. Once the code is received the password reset needs to be confirmed by calling /user/confirmforgotpassword/ endpoint.
NO{\n \"email\": [string] // Required\n}\n\n{\n \"email\": \"user@contoso.com\"\n}\n\nAllows a user to enter a confirmation code to reset a forgotten password.
\nNO{\n \"email\": [string], // Required\n \"password\": [string], // Required\n \"code\": [string] // Required\n}\n\n{\n \"email\": \"user@contoso.com\",\n \"password\": \"Abcd1234!@#$\",\n \"code\": \"123456\"\n}\n\nUsed to request a new verification link. Verification links are sent as soon as a new account is created, but they have a lifetime of 24 hr. In case the user misses the verification link, he/she can request a new one.
\nNO{\n \"email\": [string] // Required\n}\n\n{\n \"email\": \"user@contoso.com\"\n}\n\nUsed to change the user existing password. The user must be authenticated to make use of this endpoint.
\nYES{\n \"previousPassword\": [string], // Required\n \"proposedPassword\": [string] // Required\n}\n\n{\n \"previousPassword\": \"hhT4MZ#VH%h7FNgia7ZI\",\n \"proposedPassword\": \"DtQyK6#jyw$dh^w3UVLMF\"\n}\n\nSigns out users from all devices. It also invalidates all refresh tokens issued to a user. The user's current access and Id tokens remain valid until their expiry. Access and Id tokens expire one hour after they are issued.
\nYESNoneUsed to update the name and lastname of the authenticated user.
\nYES{\n \"name\": [string], // Required\n \"lastname\": [string] // Required\n}\n\n{\n \"name\": \"John\", // Required\n \"lastname\": \"Smith\" // Required\n}\n\nAll new SharePass members must sign up in order to create an account. This endpoint is used to create a new account.
\nTo complete the registration process, the users need to verify the email address by clicking on a link sent to their inbox. Note this endpoint is protected by Recaptcha V3.
\nNO{\n \"name\": [string], // Required\n \"lastname\": [string], // Required\n \"email\": [string], // Required\n \"password\": [string], // Required\n \"token\": [string] // Required\n}\n\n{\n \"name\": \"John\",\n \"lastname\": \"Smith\",\n \"username\": \"user@example.com\",\n \"password\": \"Abcd1234!@#$\",\n \"token\": \"xxxxxxxxxxxxxxxxxxx\"\n}\n\nA user is a person or a service who utilize SharePass platform. All user accounts must be verified to operate the platform.
\n","auth":{"type":"noauth","isInherited":false},"event":[{"listen":"prerequest","script":{"type":"text/javascript","exec":[""],"id":"b8eaf4d1-429c-48b0-b2e7-6c827825e2ed"}},{"listen":"test","script":{"type":"text/javascript","exec":[""],"id":"e4487c57-8f0b-4bac-9e9e-92239cef3e57"}}],"_postman_id":"993a411f-7f24-44ba-929e-e1a817ec9d5b"}],"event":[{"listen":"prerequest","script":{"type":"text/javascript","exec":[""],"id":"7f2a37ef-3b22-4b4c-8ab2-5c13af43dc23"}},{"listen":"test","script":{"type":"text/javascript","exec":[""],"id":"4bb48555-3582-4ff1-99cc-30bc1344c763"}}]}