How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Need help?

Contact us
Kardinal

Kardinal Authenticate API

How to authenticate, and manage the access and refresh tokens.

Documentation Provider Profile APIs.io OpenAPI GitHub

Kardinal Authenticate API is one of 8 APIs that Kardinal publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include Authenticate. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, an API reference, a getting-started guide, and authentication docs.

This API exposes 18 operations across 18 paths, and defines 69 schemas. It is described by OpenAPI 3.2.0, at version 2.55.0.

Requests are made against a single base URL, /api/v2.

18 operations 18 paths 69 schemas 3 GET13 POST2 PUT

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.2.0
API Version
2.55.0
Base URL
https://app.kardinal.ai/api/v2
Authentication
HTTP Bearer, HTTP Bearer, HTTP Bearer, HTTP Bearer, HTTP Bearer
Contact
https://kardinal.ai/
Resource Areas
1

Authentication & Security 5

Kardinal Authenticate API declares 5 security schemes for authenticating requests. It accepts HTTP bearer tokens (JWT) (otp_token). It accepts HTTP bearer tokens (JWT) (gdpr_token). It accepts HTTP bearer tokens (JWT) (access_token). It accepts HTTP bearer tokens (JWT) (refresh_token). It accepts HTTP bearer tokens (JWT) (password_token). By default, every request must be authenticated.

Paths & Operations 18

Across 18 paths, the API surfaces 18 operations — 3 GET, 13 POST, 2 PUT. Each is listed below with its method, path, parameters, and response codes.

Authenticate 18

How to authenticate, and manage the access and refresh tokens.

GET
/public_key
Get the public key which can be used to check the tokens
getPublicKey → 200
POST
/auth/password/requestToken
Request a password token
postRequestPasswordToken 1 param body → 204400500
POST
/auth/password/validateToken
Check if a password token is valid
validatePasswordToken body → 204400500
POST
/auth/password/reset
Reset a password for a user
resetPassword body → 204400500
GET
/auth/mfa/config
Fetch the actor's MFA config
getActorMFAConfig → 200401403500
POST
/auth/mfa/disable
Disable an OTP type in the actor's MFA config
disableMFAConfig body → 200400401403500
POST
/auth/mfa/request
Request the update of the actor's MFA config
requestMFAConfigUpdate body → 200400401403500
POST
/auth/mfa/resendOTP
Request a new OTP code for the MFA config update validation
requestNewMFAOTPCode body → 204401403429500
POST
/auth/mfa/validate
Validate the update of the actor's MFA config
validateMFAConfigUpdate body → 200400401403500
PUT
/auth/mfa/preferredType
Sets the actor's preferred OTP type in his MFA config
putMFAConfigPreferredType body → 200400401403500
PUT
/auth/mfa/regenerateBackupCodes
Regenerate the actor's backup codes
regenerateMFABackupCodes body → 200400401403500
GET
/login/methods
Retrieve the available login methods for a given username
getLoginMethods 1 param → 200400500
POST
/login
Login (returns an OTP token if MFA is configured for the user)
postLogin body → 200400403500
POST
/login/otp
Confirm login with OTP
postLoginOTP body → 200400403500
POST
/login/resendOTP
Request a new OTP code for login
requestNewLoginOTPCode → 204401403429500
POST
/login/refresh
Refresh the access token
postLoginRefresh body → 200400401403500
POST
/login/sso/azure
Login with Azure SSO
postLoginWithAzureSSO body → 200400401403500
POST
/login/sso/google
Login with Google SSO
postLoginWithGoogleSSO body → 200400401403500

Schemas 69

The contract defines 69 schemas that model the data the API accepts and returns. The most detailed are User (19 properties), MFAConfig (7 properties), LoginOTPOutput (5 properties), EnvelopedLoginAccessOutput (4 properties). Each schema is shown below with its type and property counts.

TOTPConfig
objectnull
[TOVALIDATE] Description pending review by a Kardinal engineer.
2 properties
PublicKeyJWK
object
A public key in the JSON Web Key format.
LoginOTPOutput
object
[TOVALIDATE] Description pending review by a Kardinal engineer.
5 properties
Username
string
The username is used for login, it is unique for each user, it can be either an email (for clients) or a regular username (for Kardinal's internal users).
PhoneNumber
string
Phone number in E.164 international format (e.g., +33612345678).
EnvelopedMFARequestOTPOutput
object
A JWT token with scope 'otp' valid for 10 minutes.
1 property
MFAConfigRequestEmail
object
A request to update or disable the OTP type "email" in the user's MFA configuration.
3 properties 3 required
Level
string
The user's level.
GDPRToken
string
A JSON Web Token with scope 'gdpr', to be used to approve a GDPR policy, valid for 1 hour.
Role
string
The user's role.
Password
string
A user password must contain at least: - 1 number, - 1 uppercase letter, - 1 lowercase letter, - 1 special character amongst the following: !"$%&'()+,-./:; ?@[…
AgencyId
The agency id.
EnvelopedLoginMFAOutput
object
An object containing a 'mfa' JSON Web Token, returned by a successful login of a user which needs to setup MFA authentication.
2 properties
ErrorProperties
object
[TOVALIDATE] Description pending review by a Kardinal engineer.
CountryIds
array
A list of country identifiers.
EnvelopedMFAConfig
object
[TOVALIDATE] Description pending review by a Kardinal engineer.
1 property
TokenRequest
object
An object containing a password token.
1 property
MFAConfigResendEmail
object
A request to resend the OTP code for the OTP type "email" during the user's MFA configuration.
2 properties 2 required
ClientId
The client id.
BackupCodes
array
A list of 10 unique 16-characters backup codes.
AccessToken
string
A JSON Web Token with scope 'access', to be used to access protected data, valid for 1 hour.
EnvelopedErrors
object
[TOVALIDATE] Description pending review by a Kardinal engineer.
1 property
LoginBackupCodeInput
object
Provides a backup code to fulfill the login.
1 property 1 required
RegexPrefixedIdValidation
string
An id beginning with a prefix and an underscore.
AuthenticationMethods
array
EnvelopedOTPType
object
[TOVALIDATE] Description pending review by a Kardinal engineer.
1 property
RegexNotEmpty
string
Not empty string.
GoogleSSOLogin
object
The payload to use for login through Google SSO.
1 property 1 required
PasswordRequest
object
An object containing a new password and a confirmation of the new password.
2 properties
CountryId
The country id.
RefreshToken
string
A JSON Web Token with scope 'refresh', to be used to refresh the access token, valid for 30 days.
MFAConfigResendSMS
object
A request to resend the OTP code for the OTP type "sms" during the user's MFA configuration.
2 properties 2 required
Login
object
The payload to use for login.
2 properties 2 required
MFAConfig
object
[TOVALIDATE] Description pending review by a Kardinal engineer.
7 properties
User
object
A user is a person who can use Platform's services.
19 properties 1 required
EnvelopedAuthenticationMethods
object
[TOVALIDATE] Description pending review by a Kardinal engineer.
1 property
EnvelopedBackupCodes
object
[TOVALIDATE] Description pending review by a Kardinal engineer.
1 property
EnvelopedMFARequestTOTPOutput
object
A JWT token with scope 'otp' valid for 10 minutes, together with a TOTP config.
1 property
Email
string
A valid email address.
DateTime
string
A full calendar date time, expressed in the ISO8601 date format: YYYY-MM-DDThh:mm:ssZ.
ObfuscatedPhoneNumber
stringnull
An obfuscated representation of the phone number used for MFA
UserStatus
string
The user's status.
AgencyIds
array
A list of agency identifiers.
AzureSSOLogin
object
The payload to use for login through Azure SSO.
2 properties 2 required
UserType
string
The user type.
RegionIds
array
A list of region identifiers.
PasswordToken
string
A JSON Web Token with scope 'password', to be used to set or reset one's password, valid for 24 hours (for creation) or 10 minutes (for reset).
BackupCode
string
A unique 16-characters backup code.
UsernameRequest
object
An object containing a username.
1 property
EnvelopedLoginGDPROutput
object
An object containing a 'gdpr' JSON Web Token, returned by a successful login of a user which needs to approve a GDPR policy.
2 properties
RegionId
The region id.
MFAConfigRequestTOTP
object
A request to update or disable the OTP type "totp" in the user's MFA configuration.
2 properties 2 required
PublicKeyPEM
string
A public key in the Privacy-Enhanced Mail format.
AuthenticationMethod
object
An authentication method to be used for login.
3 properties 2 required
MFAToken
string
A JSON Web Token with scope 'mfa', to be used to setup MFA authentication, valid for 1 hour.
OTPType
string
Type of OTP (One-Time Password).
Error
object
[TOVALIDATE] Description pending review by a Kardinal engineer.
3 properties 2 required
LoginOTPInput
object
Provides the OTP code to fulfill the login.
1 property 1 required
EnvelopedLoginAccessOutput
object
An object containing the access and refresh JSON Web Tokens and the user description, returned by a successful login.
4 properties
MFAConfigRequestSMS
object
A request to update or disable the OTP type "sms" in the user's MFA configuration.
3 properties 3 required
MFAConfigRegenerateBackupCodes
object
A request to regenerate the MFA's backup codes.
1 property 1 required
MFAConfigValidationTOTP
object
A validation of the update of the OTP type "totp" in the user's MFA configuration.
2 properties 2 required
MFAConfigValidationEmail
object
A validation of the update of the OTP type "email" in the user's MFA configuration.
3 properties 3 required
MFAConfigValidationSMS
object
A validation of the update of the OTP type "sms" in the user's MFA configuration.
3 properties 3 required
OTPValue
string
A 6-digits OTP code.
EnvelopedLoginOTPOutput
object
[TOVALIDATE] Description pending review by a Kardinal engineer.
1 property
OTPToken
string
A JSON Web Token with scope 'otp', to be used with an OTP (One-Time Password) value, valid for 10 minutes.
EnvelopedLoginRefreshOutput
object
An object containing the new access token.
2 properties
ObfuscatedEmail
stringnull
An obfuscated representation of the email used for MFA.

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

kardinal-authenticate-api-openapi.yml Raw ↑

Other APIs Kardinal publishes across the network.

Kardinal Core API
AE Profile APIs.io
Kardinal Management API
AE Profile APIs.io
Kardinal Order API
AE Profile APIs.io
Kardinal Plan API
AE Profile APIs.io
Kardinal Resource API
AE Profile APIs.io
Kardinal Simple Plan API
AE Profile APIs.io
Kardinal Solution API
AE Profile APIs.io
#Authenticate
← Back to K APIs
API Details
ID
kardinal:kardinal-authenticate-api
Base URL
https://app.kardinal.ai/api/v2
Docs
https://developers.kardinal.ai/
Provider
Kardinal
APIs.io →  GitHub →
Explore more
All APIs Providers APIs.io Network
Work with this as data

Every API here is available over the API and to AI agents over MCP. APIs is not yet its own endpoint on the v1 API. Reach this content through network search and the tag graph, or the MCP server below.

Installs https://mcp.apievangelist.com/mcp in Claude, Cursor, VS Code and the rest — one button, every client.

MCP tools for apis
4 tools reach this content
  • search_api_evangelistSearch every content type across the network at once.
  • find_relatedThe shared-tag relevance graph — what else covers this.
  • get_tagEverything one tag labels, across all content types.
  • guide_topicPRO — a curated bundle for a topic: area, guidance, rules, papers, stories, services.
All tools & prompts
Call it yourself
curl for this page
Search the network for this 
curl "https://api.apievangelist.com/v1/search?q=kardinal-authenticate-api&limit=10"
Everything under a tag 
curl "https://api.apievangelist.com/v1/tags/kardinal-authenticate-api"

Discovery needs no key. Full bodies and the synthesis endpoints are Pro.

Get an API key

Free tier, no email required. Sign in with whichever identity you already have.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have. Your account

Where this information came from

This is an independent, third-party profile of Kardinal Authenticate API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.