Make a brand

A new user pool with its own issuer. The org's own apps at sign-in providers sign it in too, so each must register its callback: `warnings` says so (`org_provider_apps_need_redirect_uri`), naming each. Needs `org.brands.edit`, and room under the org's plan (403 `plan_quota_exceeded`, naming the plan that has room in `required_plan`). A brand deleted in the last 30 days still takes its place: its issuer slug is held until it's purged. Recorded as `brand.created`.

POST/v1/orgs/{org}/brands

A new user pool with its own issuer. The org's own apps at sign-in providers sign it in too, so each must register its callback: warnings says so (org_provider_apps_need_redirect_uri), naming each. Needs org.brands.edit, and room under the org's plan (403 plan_quota_exceeded, naming the plan that has room in required_plan). A brand deleted in the last 30 days still takes its place: its issuer slug is held until it's purged. Recorded as brand.created.

Authorization

bearer

AuthorizationBearer <token>

An org API key (sk_live_…, sk_test_…), or an access token from the Synq issuer (the synq brand, on the accounts host) for this API.

In: header

Path Parameters

org*string

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

name*string

Length1 <= length <= 100

sign_up_enabled?boolean

Whether someone new may sign up by signing in. On by default.

sign_in_cancels_deletion?boolean

Whether a user who asked to be deleted cancels it by signing in again within the 30 days. Off by default: the sign-in is refused.

breached_password_check?boolean

Whether a new password that appears in a known data breach is refused. On by default. The check asks Have I Been Pwned's range API about the first five characters of the password's SHA-1 only, so the password never leaves Synq. The audit log names this setting breach_check.

show_last_used?boolean

Whether the sign-in page marks the way a browser last signed in at this brand, "Last used". On by default. It is remembered in a cookie on that device (only the method, and a wallet's name), never per account, so it reveals nothing about who has an account. Anyone using the same browser sees it, so turn it off for a brand used on shared devices.

built_in_methods?

Turns built-in ways to sign in on (true) or off (false); the ways it leaves out stay as they are

primary_color?string|null

background_color?string|null

support_email?|

Formatemail

Lengthlength <= 254

privacy_policy_url?|

Formaturi

Lengthlength <= 2048

terms_of_service_url?|

Formaturi

Lengthlength <= 2048

issuer_slug*string

Its issuer is https://<issuer_slug>.auth.synq.build, for good: it never changes, and is never used again after the brand is gone.

Length3 <= length <= 63

Response Body

`application/json`

`application/problem+json`

curl -X POST "https://example.com/v1/orgs/string/brands" \  -H "Content-Type: application/json" \  -d '{    "name": "string",    "issuer_slug": "string"  }'

{  "id": "string",  "org_id": "string",  "issuer_slug": "string",  "issuer": "string",  "custom_domain_issuer": "string",  "name": "string",  "is_default": true,  "sign_up_enabled": true,  "sign_in_cancels_deletion": true,  "breached_password_check": true,  "show_last_used": true,  "built_in_methods": {    "email": true,    "password": true,    "passkey": true,    "wallet": true  },  "logo_url": "string",  "primary_color": "string",  "background_color": "string",  "support_email": "string",  "privacy_policy_url": "string",  "terms_of_service_url": "string",  "created_at": "2019-08-24T14:15:22Z",  "warnings": [    {      "code": "string",      "message": "string"    }  ]}

AuthorizationCopy Anchor Link

Path ParametersCopy Anchor Link

Request BodyCopy Anchor Link

Response BodyCopy Anchor Link

201application/json

400application/problem+json

401application/problem+json

403application/problem+json

404application/problem+json

409application/problem+json

429application/problem+json

Authorization

Path Parameters

Request Body

Response Body

`application/json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`