Admin Authentication

List admin accounts

get

Lists all registered admin accounts.

Authorizations

bearerAuthmutualTLS

AuthorizationstringOptional

Bearer authentication header of the form Bearer <token>.

Responses

200

Accounts list retrieved

application/json

get/admin/accounts

HTTPcURLJavaScriptPython

GET /admin/accounts HTTP/1.1
Host: zyfla-wallet-sandbox.meeco.cloud
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

200

Accounts list retrieved

{
  "accounts": [
    {
      "account_id": "123e4567-e89b-12d3-a456-426614174000",
      "display_name": "text",
      "invitation_accepted_at": "2026-07-15T22:32:25.089Z",
      "created_at": "2026-07-15T22:32:25.089Z",
      "updated_at": "2026-07-15T22:32:25.089Z",
      "passkeys_count": 1
    }
  ]
}

Delete admin account

delete

Deletes a registered admin account and related passkeys.

Authorizations

bearerAuthmutualTLS

AuthorizationstringOptional

Bearer authentication header of the form Bearer <token>.

Path parameters

idstring · uuidRequired

ID of the admin account to delete

Responses

200

Account deleted

application/json

account_idstring · uuidRequired

Identifier of the deleted admin account.

deletedbooleanRequired

Always true when deletion succeeds.

Example: true

404

Account was not found

application/json

delete/admin/accounts/{id}

HTTPcURLJavaScriptPython

DELETE /admin/accounts/{id} HTTP/1.1
Host: zyfla-wallet-sandbox.meeco.cloud
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "account_id": "123e4567-e89b-12d3-a456-426614174000",
  "deleted": true
}

List admin invitations

get

Lists all pending, non-expired admin invitations.

Authorizations

bearerAuthmutualTLS

AuthorizationstringOptional

Bearer authentication header of the form Bearer <token>.

Responses

200

Invitations list retrieved

application/json

get/admin/invitations

HTTPcURLJavaScriptPython

GET /admin/invitations HTTP/1.1
Host: zyfla-wallet-sandbox.meeco.cloud
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

200

Invitations list retrieved

{
  "invitations": [
    {
      "account_id": "123e4567-e89b-12d3-a456-426614174000",
      "display_name": "text",
      "expires_at": "2026-07-15T22:32:25.089Z",
      "created_at": "2026-07-15T22:32:25.089Z"
    }
  ]
}

Create admin passkey invitation

post

Creates an invitation token that can be used exactly once to register the first admin passkey.

Authorizations

bearerAuthmutualTLS

AuthorizationstringOptional

Bearer authentication header of the form Bearer <token>.

Body

application/json

display_namestring · max: 255Optional

Optional display name to associate with the invitation and resulting admin account.

Example: Admin User

Responses

201

Admin passkey invitation created

application/json

account_idstring · uuidRequired

Identifier of the invitation/account record.

secret_tokenstringRequired

One-time invitation secret token to be used in registration endpoints.

expires_atstring · date-timeRequired

Invitation expiration timestamp (ISO 8601 UTC).

post/admin/invitations

HTTPcURLJavaScriptPython

POST /admin/invitations HTTP/1.1
Host: zyfla-wallet-sandbox.meeco.cloud
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 29

{
  "display_name": "Admin User"
}

201

Admin passkey invitation created

{
  "account_id": "123e4567-e89b-12d3-a456-426614174000",
  "secret_token": "text",
  "expires_at": "2026-07-15T22:32:25.089Z"
}

Delete admin invitation

delete

Deletes a pending admin invitation.

Authorizations

bearerAuthmutualTLS

AuthorizationstringOptional

Bearer authentication header of the form Bearer <token>.

Path parameters

idstring · uuidRequired

ID of the admin invitation to delete

Responses

200

Invitation deleted

application/json

invitation_idstring · uuidRequired

Identifier of the deleted invitation.

deletedbooleanRequired

Always true when deletion succeeds.

Example: true

404

Invitation was not found

application/json

delete/admin/invitations/{id}

HTTPcURLJavaScriptPython

DELETE /admin/invitations/{id} HTTP/1.1
Host: zyfla-wallet-sandbox.meeco.cloud
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "invitation_id": "123e4567-e89b-12d3-a456-426614174000",
  "deleted": true
}

Start admin passkey registration

post

Starts WebAuthn registration for a pending invitation and returns PublicKeyCredentialCreationOptionsJSON.

Use the returned options with navigator.credentials.create(...), then submit the resulting credential to /admin/invitations/accept together with challenge_id.

Body

application/json

secret_tokenstringRequired

Invitation secret token returned by /admin/invitations.

Responses

200

Registration options generated

application/json

challenge_idstring · uuidRequired

Challenge identifier required by /admin/invitations/accept.

400

Invitation is expired or invalid request data was provided

application/json

404

Invitation was not found

application/json

409

Invitation has already been used

application/json

post/admin/invitations/accept/options

HTTPcURLJavaScriptPython

POST /admin/invitations/accept/options HTTP/1.1
Host: zyfla-wallet-sandbox.meeco.cloud
Content-Type: application/json
Accept: */*
Content-Length: 23

{
  "secret_token": "text"
}

{
  "challenge_id": "123e4567-e89b-12d3-a456-426614174000",
  "options": {
    "ANY_ADDITIONAL_PROPERTY": "anything"
  }
}

Verify admin passkey registration

post

Verifies the WebAuthn registration response produced by navigator.credentials.create(...) and persists the admin passkey.

challenge_id must match the value returned by /admin/invitations/accept/options.

Body

application/json

secret_tokenstringRequired

Invitation secret token returned by /admin/invitations.

challenge_idstringRequired

Challenge identifier returned by /admin/invitations/accept/options.

Responses

200

Registration verified

application/json

account_idstring · uuidRequired

Identifier of the admin account.

passkey_idstring · uuidRequired

Identifier of the created passkey credential.

passkeys_countintegerRequired

Total number of passkeys currently registered for the account.

400

Registration challenge is invalid or expired

application/json

401

Registration verification failed

application/json

404

Invitation was not found

application/json

409

Invitation has already been used

application/json

post/admin/invitations/accept

HTTPcURLJavaScriptPython

POST /admin/invitations/accept HTTP/1.1
Host: zyfla-wallet-sandbox.meeco.cloud
Content-Type: application/json
Accept: */*
Content-Length: 95

{
  "secret_token": "text",
  "challenge_id": "text",
  "response": {
    "ANY_ADDITIONAL_PROPERTY": "anything"
  }
}

{
  "account_id": "123e4567-e89b-12d3-a456-426614174000",
  "passkey_id": "123e4567-e89b-12d3-a456-426614174000",
  "passkeys_count": 1
}

Start admin passkey authentication

post

Starts WebAuthn authentication and returns PublicKeyCredentialRequestOptionsJSON.

Use the returned options with navigator.credentials.get(...), then submit the resulting assertion to /admin/session together with challenge_id.

Responses

200

Authentication options generated

application/json

challenge_idstring · uuidRequired

Challenge identifier required by /admin/session.

post/admin/session/options

HTTPcURLJavaScriptPython

POST /admin/session/options HTTP/1.1
Host: zyfla-wallet-sandbox.meeco.cloud
Accept: */*

200

Authentication options generated

{
  "challenge_id": "123e4567-e89b-12d3-a456-426614174000",
  "options": {
    "ANY_ADDITIONAL_PROPERTY": "anything"
  }
}

Verify admin passkey authentication

post

Verifies the WebAuthn assertion produced by navigator.credentials.get(...).

On success, returns an admin access token response and sets an HTTP-only refresh token cookie (admin_refresh_token) valid for 7 days.

Body

application/json

challenge_idstringRequired

Challenge identifier returned by /admin/session/options.

Responses

200

Authentication verified

application/json

400

Authentication challenge is invalid or expired

application/json

401

Authentication verification failed

application/json

404

Passkey was not found

application/json

post/admin/session

HTTPcURLJavaScriptPython

POST /admin/session HTTP/1.1
Host: zyfla-wallet-sandbox.meeco.cloud
Content-Type: application/json
Accept: */*
Content-Length: 73

{
  "challenge_id": "text",
  "response": {
    "ANY_ADDITIONAL_PROPERTY": "anything"
  }
}

{
  "name": "Admin User",
  "access_token": "text",
  "token_type": "Bearer",
  "expires_in": 3600
}

Refresh admin access token

post

Issues a new admin access token using the HTTP-only admin_refresh_token cookie.

On success, the server rotates the refresh token value and returns it via Set-Cookie with the same /admin/session/refresh path and fixed 7-day expiry (non-sliding).

Responses

200

Access token refreshed

application/json

401

Refresh token cookie is missing, invalid, or expired

application/json

post/admin/session/refresh

HTTPcURLJavaScriptPython

POST /admin/session/refresh HTTP/1.1
Host: zyfla-wallet-sandbox.meeco.cloud
Accept: */*

{
  "name": "Admin User",
  "access_token": "text",
  "token_type": "Bearer",
  "expires_in": 3600
}