Read what the brand keeps about the signed-in person
The tenant's own JSON for this user, read-only here. Needs `me:read`.
/v1/metadataThe tenant's own JSON for this user, read-only here. Needs me:read.
Authorization
bearer An access token from this issuer for its account API (resource=<issuer>/me).
In: header
Response Body
application/json
application/problem+json
application/problem+json
application/problem+json
curl -X GET "https://example.com/v1/metadata"{ "property1": null, "property2": null}Start adding a way to sign in POST
A link request for the person, through this app: send them to sign in from this app with its `authorization_params` added. They sign in again as themselves, then use the method being added (a wallet, an emailed code, a provider), and it joins their account; a way in another person has is never merged. Methods the brand doesn't offer, or that can't show a fresh sign-in (Apple, Facebook, X, Discord, GitHub), answer 409 `sign_in_method_unavailable`; so does an email address for an account that has one. One person has at most 20 ways to sign in (409 `identity_limit_reached`). Needs `me:write`. An account that signs in with an email address nobody proved yet takes no new way to sign in: 403 `email_unverified` until the person verifies it.
Remove a passkey DELETE
It stops signing the person in. Their last way to sign in can't be removed (`last_sign_in_method`): an email address counts only with its password, or where people can sign in with an emailed code. Needs `me:write`, from a sign-in in the last 5 minutes whose time Synq proved (send the person to sign in with `max_age=300`; a provider that can't show when they signed in, such as Discord, never counts), else 403 `fresh_sign_in_required`. Send `max_age` only when you need a fresh sign-in: it asks someone signed in that way to sign in again. Recorded as `user.passkey_removed`.