Fac-360
Identity

Who am I, and what do I belong to

GET
/console/v1/session

Authorization

consoleSession
__Host-apf_console<token>

Set by POST /console/v1/sessions. HttpOnly, Secure, SameSite=Strict, Path=/, __Host- prefixed. It is never readable by JavaScript and there is no header alternative: accepting both carriers would let an attacker choose the weaker one.

In: cookie

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X GET "https://example.com/console/v1/session" \  -H "Authorization: Bearer apf_v2_tu_credencial"
{  "schemaVersion": "console.1",  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",  "userId": "2c4a230c-5085-4924-a3e1-25fb4fc5965b",  "email": "string",  "mfaEnrolled": true,  "memberships": [    {      "organizationId": "7bc05553-4b68-44e8-b7bc-37be63c6d9e9",      "organizationName": "string",      "memberRole": "OWNER"    }  ]}

Log out DELETE DELETE

Revokes this session server-side and clears the cookie. The token is opaque and server-side precisely so this can be instantaneous rather than a matter of waiting for an expiry.

Change the password POST POST

Compare-and-swap against the hash just verified, so a change racing another loses instead of silently overwriting it. EVERY session dies, the caller's included: a password change cannot be distinguished from the response to a compromise, and the rule that is right in the second case is the one that applies to both.