How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Need help?

Contact us
Kardinal

Kardinal Authenticate API

How to authenticate, and manage the access and refresh tokens.

Documentation Provider Profile APIs.io OpenAPI GitHub

Kardinal Authenticate API is one of 8 APIs that Kardinal publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include Authenticate. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, an API reference, a getting-started guide, and authentication docs.

This API exposes 18 operations across 18 paths, and defines 69 schemas. It is described by OpenAPI 3.2.0, at version 2.55.0.

Requests are made against a single base URL, /api/v2.

18 operations 18 paths 69 schemas 3 GET13 POST2 PUT

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.2.0
API Version
2.55.0
Base URL
https://app.kardinal.ai/api/v2
Authentication
HTTP Bearer, HTTP Bearer, HTTP Bearer, HTTP Bearer, HTTP Bearer
Contact
https://kardinal.ai/
Resource Areas
1

Authentication & Security 5

Kardinal Authenticate API declares 5 security schemes for authenticating requests. It accepts HTTP bearer tokens (JWT) (otp_token). It accepts HTTP bearer tokens (JWT) (gdpr_token). It accepts HTTP bearer tokens (JWT) (access_token). It accepts HTTP bearer tokens (JWT) (refresh_token). It accepts HTTP bearer tokens (JWT) (password_token). By default, every request must be authenticated.

Paths & Operations 18

Across 18 paths, the API surfaces 18 operations — 3 GET, 13 POST, 2 PUT. Each is listed below with its method, path, parameters, and response codes.

Authenticate 18

How to authenticate, and manage the access and refresh tokens.

GET
/public_key
Get the public key which can be used to check the tokens
getPublicKey → 200
POST
/auth/password/requestToken
Request a password token
postRequestPasswordToken 1 param body → 204400500
POST
/auth/password/validateToken
Check if a password token is valid
validatePasswordToken body → 204400500
POST
/auth/password/reset
Reset a password for a user
resetPassword body → 204400500
GET
/auth/mfa/config
Fetch the actor's MFA config
getActorMFAConfig → 200401403500
POST
/auth/mfa/disable
Disable an OTP type in the actor's MFA config
disableMFAConfig body → 200400401403500
POST
/auth/mfa/request
Request the update of the actor's MFA config
requestMFAConfigUpdate body → 200400401403500
POST
/auth/mfa/resendOTP
Request a new OTP code for the MFA config update validation
requestNewMFAOTPCode body → 204401403429500
POST
/auth/mfa/validate
Validate the update of the actor's MFA config
validateMFAConfigUpdate body → 200400401403500
PUT
/auth/mfa/preferredType
Sets the actor's preferred OTP type in his MFA config
putMFAConfigPreferredType body → 200400401403500
PUT
/auth/mfa/regenerateBackupCodes
Regenerate the actor's backup codes
regenerateMFABackupCodes body → 200400401403500
GET
/login/methods
Retrieve the available login methods for a given username
getLoginMethods 1 param → 200400500
POST
/login
Login (returns an OTP token if MFA is configured for the user)
postLogin body → 200400403500
POST
/login/otp
Confirm login with OTP
postLoginOTP body → 200400403500
POST
/login/resendOTP
Request a new OTP code for login
requestNewLoginOTPCode → 204401403429500
POST
/login/refresh
Refresh the access token
postLoginRefresh body → 200400401403500
POST
/login/sso/azure
Login with Azure SSO
postLoginWithAzureSSO body → 200400401403500
POST
/login/sso/google
Login with Google SSO
postLoginWithGoogleSSO body → 200400401403500

Schemas 69

The contract defines 69 schemas that model the data the API accepts and returns. The most detailed are User (19 properties), MFAConfig (7 properties), LoginOTPOutput (5 properties), EnvelopedLoginAccessOutput (4 properties). Each schema is shown below with its type and property counts.

MFAConfigValidationEmail
object
A validation of the update of the OTP type "email" in the user's MFA configuration.
3 properties 3 required
Username
string
The username is used for login, it is unique for each user, it can be either an email (for clients) or a regular username (for Kardinal's internal users).
EnvelopedBackupCodes
object
[TOVALIDATE] Description pending review by a Kardinal engineer.
1 property
EnvelopedMFARequestTOTPOutput
object
A JWT token with scope 'otp' valid for 10 minutes, together with a TOTP config.
1 property
EnvelopedLoginOTPOutput
object
[TOVALIDATE] Description pending review by a Kardinal engineer.
1 property
Login
object
The payload to use for login.
2 properties 2 required
Level
string
The user's level.
MFAConfigResendEmail
object
A request to resend the OTP code for the OTP type "email" during the user's MFA configuration.
2 properties 2 required
EnvelopedMFAConfig
object
[TOVALIDATE] Description pending review by a Kardinal engineer.
1 property
RegexPrefixedIdValidation
string
An id beginning with a prefix and an underscore.
AuthenticationMethods
array
MFAConfigValidationSMS
object
A validation of the update of the OTP type "sms" in the user's MFA configuration.
3 properties 3 required
RegionIds
array
A list of region identifiers.
EnvelopedLoginMFAOutput
object
An object containing a 'mfa' JSON Web Token, returned by a successful login of a user which needs to setup MFA authentication.
2 properties
MFAConfigValidationTOTP
object
A validation of the update of the OTP type "totp" in the user's MFA configuration.
2 properties 2 required
ObfuscatedEmail
stringnull
An obfuscated representation of the email used for MFA.
EnvelopedAuthenticationMethods
object
[TOVALIDATE] Description pending review by a Kardinal engineer.
1 property
AgencyId
The agency id.
TokenRequest
object
An object containing a password token.
1 property
LoginOTPOutput
object
[TOVALIDATE] Description pending review by a Kardinal engineer.
5 properties
OTPType
string
Type of OTP (One-Time Password).
AzureSSOLogin
object
The payload to use for login through Azure SSO.
2 properties 2 required
GDPRToken
string
A JSON Web Token with scope 'gdpr', to be used to approve a GDPR policy, valid for 1 hour.
UsernameRequest
object
An object containing a username.
1 property
MFAToken
string
A JSON Web Token with scope 'mfa', to be used to setup MFA authentication, valid for 1 hour.
RefreshToken
string
A JSON Web Token with scope 'refresh', to be used to refresh the access token, valid for 30 days.
MFAConfigRequestTOTP
object
A request to update or disable the OTP type "totp" in the user's MFA configuration.
2 properties 2 required
CountryIds
array
A list of country identifiers.
PublicKeyJWK
object
A public key in the JSON Web Key format.
User
object
A user is a person who can use Platform's services.
19 properties 1 required
ErrorProperties
object
[TOVALIDATE] Description pending review by a Kardinal engineer.
EnvelopedErrors
object
[TOVALIDATE] Description pending review by a Kardinal engineer.
1 property
OTPValue
string
A 6-digits OTP code.
LoginOTPInput
object
Provides the OTP code to fulfill the login.
1 property 1 required
AuthenticationMethod
object
An authentication method to be used for login.
3 properties 2 required
PhoneNumber
string
Phone number in E.164 international format (e.g., +33612345678).
AccessToken
string
A JSON Web Token with scope 'access', to be used to access protected data, valid for 1 hour.
UserType
string
The user type.
DateTime
string
A full calendar date time, expressed in the ISO8601 date format: YYYY-MM-DDThh:mm:ssZ.
ObfuscatedPhoneNumber
stringnull
An obfuscated representation of the phone number used for MFA
Email
string
A valid email address.
UserStatus
string
The user's status.
BackupCode
string
A unique 16-characters backup code.
EnvelopedOTPType
object
[TOVALIDATE] Description pending review by a Kardinal engineer.
1 property
TOTPConfig
objectnull
[TOVALIDATE] Description pending review by a Kardinal engineer.
2 properties
OTPToken
string
A JSON Web Token with scope 'otp', to be used with an OTP (One-Time Password) value, valid for 10 minutes.
RegionId
The region id.
MFAConfigRegenerateBackupCodes
object
A request to regenerate the MFA's backup codes.
1 property 1 required
PasswordRequest
object
An object containing a new password and a confirmation of the new password.
2 properties
Error
object
[TOVALIDATE] Description pending review by a Kardinal engineer.
3 properties 2 required
AgencyIds
array
A list of agency identifiers.
BackupCodes
array
A list of 10 unique 16-characters backup codes.
LoginBackupCodeInput
object
Provides a backup code to fulfill the login.
1 property 1 required
EnvelopedMFARequestOTPOutput
object
A JWT token with scope 'otp' valid for 10 minutes.
1 property
RegexNotEmpty
string
Not empty string.
Role
string
The user's role.
EnvelopedLoginRefreshOutput
object
An object containing the new access token.
2 properties
Password
string
A user password must contain at least: - 1 number, - 1 uppercase letter, - 1 lowercase letter, - 1 special character amongst the following: !"$%&'()+,-./:; ?@[…
CountryId
The country id.
MFAConfigRequestSMS
object
A request to update or disable the OTP type "sms" in the user's MFA configuration.
3 properties 3 required
PasswordToken
string
A JSON Web Token with scope 'password', to be used to set or reset one's password, valid for 24 hours (for creation) or 10 minutes (for reset).
ClientId
The client id.
EnvelopedLoginAccessOutput
object
An object containing the access and refresh JSON Web Tokens and the user description, returned by a successful login.
4 properties
PublicKeyPEM
string
A public key in the Privacy-Enhanced Mail format.
MFAConfig
object
[TOVALIDATE] Description pending review by a Kardinal engineer.
7 properties
MFAConfigResendSMS
object
A request to resend the OTP code for the OTP type "sms" during the user's MFA configuration.
2 properties 2 required
MFAConfigRequestEmail
object
A request to update or disable the OTP type "email" in the user's MFA configuration.
3 properties 3 required
GoogleSSOLogin
object
The payload to use for login through Google SSO.
1 property 1 required
EnvelopedLoginGDPROutput
object
An object containing a 'gdpr' JSON Web Token, returned by a successful login of a user which needs to approve a GDPR policy.
2 properties

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

kardinal-authenticate-api-openapi.yml Raw ↑

Other APIs Kardinal publishes across the network.

Kardinal Core API
AE Profile APIs.io
Kardinal Management API
AE Profile APIs.io
Kardinal Order API
AE Profile APIs.io
Kardinal Plan API
AE Profile APIs.io
Kardinal Resource API
AE Profile APIs.io
Kardinal Simple Plan API
AE Profile APIs.io
Kardinal Solution API
AE Profile APIs.io
#Authenticate
← Back to K APIs
API Details
ID
kardinal:kardinal-authenticate-api
Base URL
https://app.kardinal.ai/api/v2
Docs
https://developers.kardinal.ai/
Provider
Kardinal
APIs.io →  GitHub →
Explore more
All APIs Providers APIs.io Network
Work with this as data

Every API here is available over the API and to AI agents over MCP. APIs is not yet its own endpoint on the v1 API. Reach this content through network search and the tag graph, or the MCP server below.

Installs https://mcp.apievangelist.com/mcp in Claude, Cursor, VS Code and the rest — one button, every client.

MCP tools for apis
4 tools reach this content
  • search_api_evangelistSearch every content type across the network at once.
  • find_relatedThe shared-tag relevance graph — what else covers this.
  • get_tagEverything one tag labels, across all content types.
  • guide_topicPRO — a curated bundle for a topic: area, guidance, rules, papers, stories, services.
All tools & prompts
Call it yourself
curl for this page
Search the network for this 
curl "https://api.apievangelist.com/v1/search?q=kardinal-authenticate-api&limit=10"
Everything under a tag 
curl "https://api.apievangelist.com/v1/tags/kardinal-authenticate-api"

Discovery needs no key. Full bodies and the synthesis endpoints are Pro.

Get an API key

Free tier, no email required. Sign in with whichever identity you already have.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have. Your account

Where this information came from

This is an independent, third-party profile of Kardinal Authenticate API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.