API expansion
The /api/v1 API is now much more comprehensive:
- Password, TOTP, and SSO sign-in for the API —
POST /api/v1/auth/login(with a single-use 2FA challenge flow) and a server-brokered OIDC flow can now mint API tokens directly, alongside the existing pre-created tokens in Settings → API.GET /api/v1/auth/discoverlets clients detect server capabilities (SSO on/off, local login, version) before authenticating. - Non-admin API access with per-client scoping — API tokens belonging to regular users now work on read and day-to-day endpoints (clients, repositories, archives, plans, jobs, queue, log, schedules) and see exactly the clients assigned to them, matching the web UI's permission model. Admin-only endpoints (user management, storage config, deletions) still require an admin token, and existing admin tokens behave exactly as before.
- Session management —
GET /api/v1/auth/sessionslists sign-in tokens with device name and last-seen IP; individual tokens can be revoked via the API or from Settings → API. - New endpoints:
GET /api/v1/dashboard(one-call summary: client/job counts, storage, active jobs, unread notifications),GET /api/v1/notifications(+ mark read/read-all),GET /api/v1/jobs/{id},POST /api/v1/queue/{id}/canceland/retry, paginated file-catalog browsing (GET .../archives/{archiveId}/fileswith cursor pagination), andPOST /api/v1/clients/{id}/restoreto queue file restores. - Secrets stay off limits — sign-in-minted tokens can never read repository passphrases or S3 credentials, and the client registration key is no longer returned to non-admin callers.