Backend API

Server-to-server endpoints authenticated with your secret key.

http

Authorization: Bearer sk_test_…

These endpoints send no CORS headers, so browsers can't call them.
Every response is Cache-Control: no-store.
In JavaScript, use the backend client instead of calling them directly.

List users

http

GET /v1/users?limit=20&offset=0

json

{ "data": [ { "id": "user_…", "emailAddresses": [ … ], "privateMetadata": {}, "banned": false, … } ] }

Get a user

http

GET /v1/users/{userId}

404 if the user doesn't exist in this instance.

Delete a user

http

DELETE /v1/users/{userId}

200 → { "id": "user_…", "deleted": true }. Also deletes emails, password and sessions.

Remove a user's two-factor authentication

http

DELETE /v1/users/{userId}/mfa

For users locked out of both their authenticator and backup codes. Verify their identity first. 200 → { id, twoFactorEnabled: false }

Revoke a session

http

POST /v1/sessions/{sessionId}/revoke

200 → { "id": "sess_…", "status": "revoked" }

http

PUT /v1/instance/oauth/{google|github}
{ "clientId": "…", "clientSecret": "…", "enabled": true }

200 → { provider, enabled, clientId, redirectUri }. The secret is encrypted at rest and never returned. redirectUri is the callback URL to register with the provider.

http

PUT /v1/instance/legal
{ "required": true, "termsUrl": "https://…", "privacyUrl": "https://…", "version": "2026-10-21" }

See Require terms at sign-up.

Example with curl

bash

curl https://users.daywalker.dev/v1/users?limit=5 \
  -H "Authorization: Bearer $DAYWALKER_SECRET_KEY"

Enterprise SSO and SCIM

Endpoint	Description
`GET` / `POST /v1/saml_connections`	List or create SAML connections (`name`, `domains`, `organizationId?`, `metadataXml` or `idpEntityId` + `ssoUrl` + `certificates`)
`GET` / `PATCH` / `DELETE /v1/saml_connections/{id}`	Read, update, delete. `PATCH` accepts `enabled`, `ssoRequired`, `scimAdminGroups`, `sloUrl` and `singleLogout`
`POST /v1/saml_connections/{id}/scim_token`	Turn on SCIM provisioning. Returns the token once; calling again replaces it
`DELETE /v1/saml_connections/{id}/scim_token`	Turn SCIM off and revoke the token

The identity provider itself calls /v1/scim/v2/{connectionId}/Users and /Groups with the SCIM token. See Enterprise SSO.

Endpoint	Description
`GET /v1/instance/protection`	Email rules, the Turnstile site key (never the secret) and the two-factor requirement
`PATCH /v1/instance/protection`	Any of `allowedDomains`, `blockedDomains`, `blockDisposableEmails`, `captcha` (`{ siteKey, secretKey }` or `null`), `requireTwoFactor`, `twoFactorGraceDays`

Organizations

Endpoint	Description
`GET` / `PATCH /v1/organizations/{orgId}`	One organization; `PATCH { requireTwoFactor }`
`GET /v1/organizations?limit=&offset=`	List organizations in your instance
`GET /v1/organizations/{orgId}/members`	Members as `{ userId, role, joinedAt }`

Webhooks

Endpoint	Description
`GET /v1/webhooks`	List endpoints
`POST /v1/webhooks`	Create `{ url, events?, description? }`. Returns the signing `secret` once
`GET` / `PATCH` / `DELETE /v1/webhooks/{id}`	Read, update (`url`, `events`, `description`, `enabled`), delete
`POST /v1/webhooks/{id}/rotate_secret`	New signing secret; the old one stops working
`GET /v1/webhooks/{id}/deliveries?limit=`	Delivery log (status, attempts, errors)
`POST /v1/webhooks/{id}/test`	Send a `webhook.test` event
`POST /v1/webhooks/deliveries/{deliveryId}/retry`	Re-queue a delivery

See the Webhooks guide.