13 endpoints

# Authentication

JWT authentication, MFA setup, password management, and session control.

POST`/auth/login`LoginAuthenticate with email and password. Returns a JWT token. If MFA is enabled, returns mfa_required: true with a temporary mfa_token instead of a full JWT.

POST`/auth/logout`LogoutInvalidate the current JWT token and log out the user.

GET`/auth/me`Get Current UserReturns authenticated user information including their linked employee record and company.

GET`/auth/permissions`Get My PermissionsReturns the full list of access permissions the current user holds, resolved from their groups and individual overrides.

POST`/auth/refresh`Refresh TokenExchange a valid (or recently-expired) JWT for a fresh one.

POST`/auth/change-password`Change PasswordChange the current user's password. If user_must_change_password is true, current_password is optional.

POST`/auth/request-password-reset`Request Password ResetSend a password reset email. Always returns 200 to prevent email enumeration.

POST`/auth/reset-password`Reset PasswordSet a new password using a reset token received by email.

GET`/auth/mfa/setup`Get MFA SetupGet a QR code URL and secret to configure a TOTP authenticator app (e.g. Google Authenticator, Authy).

POST`/auth/mfa/verify-setup`Verify & Enable MFAVerify a 6-digit TOTP code to confirm MFA setup. Returns backup codes on success.

POST`/auth/mfa/verify`Verify MFA During LoginProvide a TOTP code or backup code during login to receive a full JWT token.

POST`/auth/mfa/disable`Disable MFADisable MFA for the current user (requires password confirmation).

GET`/auth/audit`Login Audit LogGet login history for the company (HR/Admin only).

---

**URL:** https://cube-hr.co.uk/docs/authentication