# authiane.com website API

> Early-access waitlist, status probe and OAuth-protected waitlist statistics

The public website of Authiane exposes a small API. Without authentication: joining the early-access waitlist and a status probe. With OAuth 2.0 client credentials (RFC 6749 section 4.4) and the scope waitlist:stats:read: aggregate waitlist statistics (counts only, no personal data). Authorization server metadata: https://www.authiane.com/.well-known/oauth-authorization-server (RFC 8414); protected resource metadata: https://www.authiane.com/.well-known/oauth-protected-resource/api/v1 (RFC 9728). Production clients are issued by Das Digitale Momentum on request. Sandbox: the same contract under https://www.authiane.com/sandbox stores nothing, returns fixed example statistics and accepts the public OAuth client sandbox/sandbox, so agents can test every call without credentials. Access tokens are JWTs valid for 900 seconds. Versioning: the major version is part of the path (/api/v1/); breaking changes only appear under a new major path; deprecated operations are flagged and keep working. Rate limits: 120 requests per minute per client for GET and HEAD on /api/v1/status and for every sandbox call, 30 for every other call, announced with RateLimit-* headers. Errors: every error response is typed as Error {error, message}; the token endpoint answers with OAuthError {error, error_description} (RFC 6749 section 5.2). Submit an address only with the explicit consent of its owner.

- Version: 1.1.0
- Server: https://www.authiane.com
- Specification: https://www.authiane.com/openapi.json
- Documentation: https://www.authiane.com/developers/

## GET /api/v1/status

**Service status and discovery links** (operationId: `getStatus`)

Zero-auth probe that confirms the API is up, names the environment and points to the documentation and this specification.

Responses:

- 200: Service is up.
- 405: Only GET and HEAD are allowed. Error codes: method_not_allowed.
- 429: Rate limit exceeded. Rate limits: 120 requests per minute per client for GET and HEAD on /api/v1/status and for every sandbox call, 30 for every other call. Error codes: rate_limited.
- 500: Unexpected server error. Error codes: internal_error.

## POST /api/v1/oauth/token

**Issue an access token (client credentials grant)** (operationId: `createAccessToken`)

Exchanges client credentials for a Bearer access token. Authenticate the client with HTTP Basic (client_secret_basic) or with client_id and client_secret in the form body (client_secret_post). Omitting scope grants all scopes of the client. Responses are never cached.

Request body (application/x-www-form-urlencoded):

- `grant_type` (required, client_credentials): 
- `scope` (optional, string): Space-separated scopes: waitlist:stats:read.
- `client_id` (optional, string): Only for client_secret_post.
- `client_secret` (optional, string): Only for client_secret_post.

Responses:

- 200: Access token issued.
- 400: Missing or unsupported grant type, wrong content type or unknown scope. OAuth error codes: invalid_request, unsupported_grant_type, invalid_scope.
- 401: Client authentication failed. OAuth error codes: invalid_client.
- 405: Only POST is allowed. Error codes: method_not_allowed.
- 413: Body larger than 64 KB. Error codes: payload_too_large.
- 429: Rate limit exceeded. Rate limits: 120 requests per minute per client for GET and HEAD on /api/v1/status and for every sandbox call, 30 for every other call. Error codes: rate_limited.
- 500: Unexpected server error. Error codes: internal_error.

## POST /api/v1/waitlist

**Join the early-access waitlist** (operationId: `joinWaitlist`)

Stores an e-mail address with its consent timestamp and answers synchronously. No authentication. The same address can be submitted again; optional answers are merged. The response is identical for new and known addresses. Form-encoded submissions (no JavaScript) are redirected to a thanks page instead of receiving JSON. In the sandbox nothing is stored.

Request body (application/json or application/x-www-form-urlencoded):

- `email` (required, email): E-mail address of the person joining; stored lower-cased.
- `consent` (required, true): Must be true: the person agreed to be notified when Authiane opens.
- `source` (optional, hero | cta): Optional: which form on the site was used.
- `lang` (optional, en | de): Optional: language for the notification.

Responses:

- 200: Stored, updated or already known.
- 303: Form-encoded submission accepted; redirect to /thanks/ or /de/danke/.
- 400: Unknown field, invalid enum value or malformed JSON. Error codes: invalid_request, invalid_json.
- 405: Only POST is allowed. Error codes: method_not_allowed.
- 413: Body larger than 64 KB. Error codes: payload_too_large.
- 415: Content-Type is neither application/json nor application/x-www-form-urlencoded. Error codes: unsupported_media_type.
- 422: Invalid e-mail address or consent not given. Error codes: invalid_email, consent_required.
- 429: Rate limit exceeded. Rate limits: 120 requests per minute per client for GET and HEAD on /api/v1/status and for every sandbox call, 30 for every other call. Error codes: rate_limited.
- 500: Unexpected server error. Error codes: internal_error.

## GET /api/v1/waitlist/stats

**Aggregate waitlist statistics** (operationId: `getWaitlistStats`)

Total sign-ups, sign-ups in the last 7 and 30 days, and counts by language, role, use case and form. Contains no e-mail addresses or other personal data. Requires an access token with the scope waitlist:stats:read issued for this environment.

Responses:

- 200: Current statistics.
- 401: Missing, invalid or expired access token. Error codes: unauthorized, invalid_token.
- 403: The access token lacks the scope waitlist:stats:read. Error codes: insufficient_scope.
- 405: Only GET and HEAD are allowed. Error codes: method_not_allowed.
- 429: Rate limit exceeded. Rate limits: 120 requests per minute per client for GET and HEAD on /api/v1/status and for every sandbox call, 30 for every other call. Error codes: rate_limited.
- 500: Unexpected server error. Error codes: internal_error.

## POST /api/waitlist (deprecated)

**Join the waitlist (unversioned alias)** (operationId: `joinWaitlistLegacy`)

Unversioned alias of POST /api/v1/waitlist kept for compatibility with existing forms. Prefer the versioned path.

Request body (application/json or application/x-www-form-urlencoded):

- `email` (required, email): E-mail address of the person joining; stored lower-cased.
- `consent` (required, true): Must be true: the person agreed to be notified when Authiane opens.
- `source` (optional, hero | cta): Optional: which form on the site was used.
- `lang` (optional, en | de): Optional: language for the notification.

Responses:

- 200: Stored, updated or already known.
- 303: Form-encoded submission accepted; redirect to /thanks/ or /de/danke/.
- 400: Unknown field, invalid enum value or malformed JSON. Error codes: invalid_request, invalid_json.
- 405: Only POST is allowed. Error codes: method_not_allowed.
- 413: Body larger than 64 KB. Error codes: payload_too_large.
- 415: Content-Type is neither application/json nor application/x-www-form-urlencoded. Error codes: unsupported_media_type.
- 422: Invalid e-mail address or consent not given. Error codes: invalid_email, consent_required.
- 429: Rate limit exceeded. Rate limits: 120 requests per minute per client for GET and HEAD on /api/v1/status and for every sandbox call, 30 for every other call. Error codes: rate_limited.
- 500: Unexpected server error. Error codes: internal_error.

---

Source: https://www.authiane.com/openapi.json