Base URL https://api.cube-hr.co.uk/api/v1
13 endpoints
JWT authentication, MFA setup, password management, and session control.
/auth/login
Authenticate with email and password. Returns a JWT token. If MFA is enabled, returns mfa_required: true with a temporary mfa_token instead of a full JWT.
/auth/logout
Invalidate the current JWT token and log out the user.
/auth/me
Returns authenticated user information including their linked employee record and company.
/auth/permissions
Returns the full list of access permissions the current user holds, resolved from their groups and individual overrides.
/auth/refresh
Exchange a valid (or recently-expired) JWT for a fresh one.
/auth/change-password
Change the current user's password. If user_must_change_password is true, current_password is optional.
/auth/request-password-reset
Send a password reset email. Always returns 200 to prevent email enumeration.
/auth/reset-password
Set a new password using a reset token received by email.
/auth/mfa/setup
Get a QR code URL and secret to configure a TOTP authenticator app (e.g. Google Authenticator, Authy).
/auth/mfa/verify-setup
Verify a 6-digit TOTP code to confirm MFA setup. Returns backup codes on success.
/auth/mfa/verify
Provide a TOTP code or backup code during login to receive a full JWT token.
/auth/mfa/disable
Disable MFA for the current user (requires password confirmation).
/auth/audit
Get login history for the company (HR/Admin only).