List the signed-in person's ways to sign in
Their wallets, their email address and the accounts at providers they sign in with, oldest first. Passkeys are at `/v1/passkeys`. Needs `me:read`.
/v1/identitiesTheir wallets, their email address and the accounts at providers they sign in with, oldest first. Passkeys are at /v1/passkeys. Needs me:read.
Authorization
bearer An access token from this issuer for its account API (resource=<issuer>/me).
In: header
Response Body
application/json
application/problem+json
application/problem+json
application/problem+json
curl -X GET "https://example.com/v1/identities"{ "data": [ { "id": "string", "provider": "string", "subject": "string", "handle": "string", "password": true, "created_at": "2019-08-24T14:15:22Z", "last_used_at": "2019-08-24T14:15:22Z" } ]}Remove a way to sign in DELETE
A wallet, the email address (with its password) or an account at a provider stops signing the person in. Their last way to sign in can't be removed (`last_sign_in_method`): an email address counts only with its password, or where people can sign in with an emailed code. Removing their primary wallet makes their most recently used other wallet primary. Removing the email address leaves it their contact address, no longer verified. Sessions it signed in keep going: end them with `DELETE /v1/sessions/{session}`. Passkeys are removed at `/v1/passkeys`. Needs `me:write`, from a sign-in in the last 5 minutes whose time Synq proved (send the person to sign in with `max_age=300`; a provider that can't show when they signed in, such as Discord, never counts), else 403 `fresh_sign_in_required`. Send `max_age` only when you need a fresh sign-in: it asks someone signed in that way to sign in again. Recorded as `user.identity_unlinked`.
Start adding a way to sign in POST
A link request for the person, through this app: send them to sign in from this app with its `authorization_params` added. They sign in again as themselves, then use the method being added (a wallet, an emailed code, a provider), and it joins their account; a way in another person has is never merged. Methods the brand doesn't offer, or that can't show a fresh sign-in (Apple, Facebook, X, Discord, GitHub), answer 409 `sign_in_method_unavailable`; so does an email address for an account that has one. One person has at most 20 ways to sign in (409 `identity_limit_reached`). Needs `me:write`. An account that signs in with an email address nobody proved yet takes no new way to sign in: 403 `email_unverified` until the person verifies it.