Version 0.1

HTTP and RPC API

Browser-facing JSON plus a private, versioned service boundary.

Protocol status

Browser WebAuthn ceremonies use HTTP/JSON. Trusted consumers can use Connect, gRPC-Web or gRPC for identity management and durable event streaming with separately scoped bearer credentials.

Endpoints

GET/healthzPublic

Process liveness

GET/readyzPublic

SableDB-backed readiness

GET/.well-known/jwks.jsonPublic

ES256 verification keys

POST/v1/passkeys/registration/optionsOrigin + bootstrap

Start registration

POST/v1/passkeys/registration/verifyOrigin + bootstrap

Finish registration

POST/v1/passkeys/authentication/optionsOrigin

Start sign-in

POST/v1/passkeys/authentication/verifyOrigin

Finish sign-in

GET/v1/accountSession

Read profile and identifiers

POST/v1/account/profilePasskey session

Update basic profile

POST/v1/account/identifiersRecent passkey

Add an email or phone

GET/v1/credentialsSession

List account passkeys

POST/v1/sign-outOrigin

Revoke current session

Account identity

Passkeys, canonical email or E.164 phone identifiers, and optional given, family and display names attach to a stable account UUID. Existing email-only request bodies remain valid. The identity data model documents every stored field and the data deliberately excluded from each response.

Discovery and operations

The JWKS endpoint publishes active, staged and overlapping retired verification keys. Runtime capability metadata reports whether scheduled backups are configured, the last successful backup time and current backup health. Backup and key-rotation commands are operator CLI surfaces, not public HTTP endpoints.

Error behaviour

Security-sensitive failures are explicit. Invalid origins, missing ceremonies, expired sessions, unknown credentials and an unavailable durable store do not degrade into successful empty responses.

Private gRPC boundary

rustyauth.identity.v1.IdentityService supports safe user reads, exact search, profile and email/phone updates, and passkey rename/revoke operations. rustyauth.events.v1.AuthEventService provides resumable server streaming. Passkey credential material never appears in RPC responses.