Members API

Household membership administration

📄️List currently redeemable household invitations

Requires members.manage and an ordinary current session. Only unconsumed, unrevoked, unexpired invitation metadata is returned. The one-time bearer token and its stored verifier are never available from this or any other read route.

📄️Create a one-use household membership invitation

Requires members.manage and an exact same-origin proof for cookie requests. The raw invitation token is returned only in this 201 response; Jiandu stores only a domain-separated verifier. The requested role must be an existing household role and may not grant any permission the creator lacks.

📄️Revoke an unconsumed household membership invitation

Requires members.manage and an exact same-origin ordinary browser session. Revocation is idempotent and permanently prevents future redemption.

📄️Create a local username/password household account

Requires members.manage, same-origin proof for cookie requests, and a normal session rather than a personal access token. The new principal is always kind USER; the selected existing household role is assigned by the authorization service.

📄️Set a local account username and password

A member may update an existing local credential. Only the installation Owner may recover another local USER credential or establish the first local password for an OIDC-only member. Password changes revoke that principal's sessions and personal access tokens. Personal access tokens cannot call this route.

📄️List the caller's current personal access token metadata

Only normal sessions may manage credentials. Raw bearer tokens and stored digests are never returned.

📄️Create a scoped, expiring personal access token

Requires same-origin proof for cookie requests and a normal session. The raw bearer is returned only in this 201 response; personal access tokens cannot manage credentials, including other tokens.

📄️Revoke one of the caller's personal access tokens

Requires same-origin proof for cookie requests and a normal session. It is idempotent and never reveals whether a token identifier belonged to another member.