{
    "service": "id.collekton.com",
    "version": "2.3.1",
    "description": "Collekton Identity Provider",
    "endpoints": {
        "POST /auth/register": "Register new user (sends email confirmation, returns tokens)",
        "POST /auth/login": "Authenticate user",
        "POST /auth/email-status": "Check whether an email is registered (body: email)",
        "GET /auth/registered": "Check whether an email is registered (query: email)",
        "POST /auth/refresh": "Refresh access token",
        "POST /auth/logout": "Invalidate refresh token and SSO session",
        "POST /auth/verify-2fa": "Verify 2FA code during login",
        "POST /auth/complete-2fa-setup": "Complete 2FA setup during login",
        "POST /auth/sso-exchange": "Exchange one-time SSO token for JWT",
        "GET /auth/check": "Silent SSO session check (redirect flow)",
        "POST /auth/logout-all": "Logout from all devices/sessions",
        "GET /api/mfa/status": "Get 2FA status (requires JWT)",
        "POST /api/mfa/setup": "Begin 2FA setup (requires JWT)",
        "POST /api/mfa/verify-setup": "Complete 2FA setup (requires JWT)",
        "POST /api/mfa/disable": "Disable 2FA (requires JWT)",
        "POST /api/mfa/regenerate-backup-codes": "Regenerate backup codes (requires JWT)",
        "GET /api/domains/check": "Check subdomain availability (public)",
        "GET /api/domains/suggestions": "Get subdomain suggestions (public)",
        "GET /api/domains/mine": "Get user reservations (requires JWT)",
        "POST /api/domains/reserve": "Reserve a subdomain (requires JWT)",
        "DELETE /api/domains/{subdomain}": "Release a reservation (requires JWT)",
        "POST /api/users/invite": "Invite user: find-or-create + assign to app (requires superuser JWT)",
        "GET /api/users/check": "Check if user exists by email (requires JWT)",
        "POST /api/users/assign": "Assign user to app (requires superuser JWT)",
        "GET /api/modules/catalog": "Public module catalog with domains and pricing (no auth, ?account_type=gallery)",
        "GET /api/configs/{id}/modules": "Module catalog with live subscription state (requires JWT)",
        "POST /api/configs/{id}/modules": "Activate module (requires JWT)",
        "DELETE /api/configs/{id}/modules/{module_id}": "Cancel module (requires JWT)",
        "GET /api/configs/{id}/features": "List features for app config (requires JWT)",
        "POST /api/configs/{id}/features": "Register feature (requires JWT)",
        "DELETE /api/configs/{id}/features/{feature_id}": "Cancel feature (requires JWT)",
        "POST /api/configs/{id}/core-tier": "Set core tier (requires JWT)",
        "GET /api/configs/{id}/usage": "Usage payload for fin.c (requires JWT)",
        "POST /api/application/provision": "Provision new application (claim/create account + config + infra, requires JWT)",
        "GET /api/usage/{account_id}": "Account-level usage aggregation (user JWT with matching account_id, or FIN_INTERNAL_API_KEY)",
        "GET /api/usage/config/{config_id}": "Config usage snapshot (user JWT with app access, or FIN_INTERNAL_API_KEY)",
        "POST /internal/shadow/upsert": "Internal: upsert shadow principal by email (API key + optional X-Host allowlist)",
        "POST /cal/tokens": "Mint calendar feed token (user JWT; raw secret once)",
        "GET /cal/tokens": "List calendar feed tokens (user JWT; no secrets)",
        "DELETE /cal/tokens/{token_id}": "Revoke calendar feed token (user JWT)",
        "POST /internal/cal/tokens/resolve": "Internal: resolve raw feed token \u2192 cid (CAL_RESOLVE_API_KEY)",
        "POST /internal/cal/tokens/fetched": "Internal: cal telemetry for last_fetched_at (CAL_RESOLVE_API_KEY)",
        "GET /api/usage/config/{config_id}/rollups": "Pre-aggregated monthly usage rollup document (user JWT with app access, or FIN_INTERNAL_API_KEY; ?month=YYYY-MM)",
        "GET /internal/fin/registry": "Internal: price registry snapshot (FIN_INTERNAL_API_KEY; ?version, ?as_of)",
        "POST /internal/fin/registry/register": "Internal: auto-register meter paths at aggregation (FIN_INTERNAL_API_KEY)",
        "GET /internal/fin/tiers": "Internal: active tier definitions (FIN_INTERNAL_API_KEY)",
        "GET /internal/fin/apps/{id}/billing-config": "Internal: per-instance tier + overage mode (FIN_INTERNAL_API_KEY)",
        "GET /internal/fin/apps/{id}/billing-declaration": "Internal: current billing declaration for fin.c resolve (FIN_INTERNAL_API_KEY)",
        "GET /internal/fin/billing-declarations/{id}/{version}": "Internal: exact frozen declaration revision for deterministic fin.c resolve (FIN_INTERNAL_API_KEY)",
        "GET /api/configs/{id}/billing-declaration": "Current billing declaration (JWT)",
        "POST /api/configs/{id}/billing-declaration": "Save billing declaration + VIES (JWT admin)",
        "GET /api/billing/declarations/current": "Jarvis compat: current declaration (?app_config_id=)",
        "POST /api/billing/declarations": "Jarvis compat: save declaration (body.app_config_id)",
        "GET /api/fin/billing-declarations/hitl": "HITL queue for non-EU business evidence (superuser JWT)",
        "POST /api/email-domain": "Provision SES sending domain (JWT admin)",
        "GET /api/email-domain": "Current email domain identity for app (JWT admin)",
        "GET /api/email-domain/{id}": "Email domain identity + DNS records (JWT admin)",
        "POST /api/email-domain/{id}/check": "Manual DNS check (JWT admin, 1/min)",
        "POST /api/email-domain/{id}/reverify": "Recover failed identity (JWT admin)",
        "DELETE /api/email-domain/{id}": "Revoke identity (JWT owner)",
        "GET /health": "Health check",
        "GET /.well-known/jwks.json": "Public keys for JWT verification",
        "GET /.well-known/openid-configuration": "OIDC discovery document (for API Gateway JWT authorizers)"
    }
}