API Documentation

Complete API reference for RentAmac Portal endpoints

Base URL: https://api.rentamac.io
Authentication: Bearer token required for all authenticated endpoints.

POST

/login

Authenticate with email and password. If the account has two-factor enabled, the first call answers 401 with detail "RequiresTwoFactor" and a twoFactorMethod field ("authenticator" or "email"); resubmit the same credentials together with twoFactorCode or twoFactorRecoveryCode.

Parameters

email

string

body

Required

User's email address

password

string

body

Required

User's password

twoFactorCode

string

body

Optional

2FA code from authenticator app (optional)

twoFactorRecoveryCode

string

body

Optional

2FA recovery code (optional, alternative to twoFactorCode)

Request Body

{
  "email": "user@example.com",
  "password": "yourpassword",
  "twoFactorCode": "123456",
  "twoFactorRecoveryCode": null
}

Response

{
  "tokenType": "Bearer",
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expiresIn": 3600,
  "refreshToken": "def50200..."
}

Authentication tokens

POST

/refresh

Refresh an expired access token using refresh token

Parameters

refreshToken

string

body

Required

Valid refresh token obtained from login

Request Body

Refresh token to generate new access token

{
  "refreshToken": "def50200..."
}

Response

{
  "tokenType": "Bearer",
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expiresIn": 3600,
  "refreshToken": "def50200..."
}

New authentication tokens

POST

/register

Parameters

email

string

body

Required

Valid email address for the new account

password

string

body

Required

Strong password for the account (minimum requirements apply)

Request Body

User registration details

{
  "email": "newuser@example.com",
  "password": "securepassword123"
}

Response

true

Registration success status

GET

/confirmEmail

Confirm user email address with verification code

Parameters

userId

string

query

Required

User ID from registration

code

string

query

Required

Email confirmation code sent to user's email

changedEmail

string

query

Optional

New email if email was changed (optional)

Response

true

Email confirmation success status

POST

/forgotPassword

Request password reset code to be sent to email

Parameters

email

string

body

Required

Email address of the account to reset password for

Request Body

Email address for password reset

{
  "email": "user@example.com"
}

Response

true

Password reset request success status

POST

/resetPassword

Reset password using reset code from email

Parameters

email

string

body

Required

Email address of the account

resetCode

string

body

Required

Password reset code received via email

newPassword

string

body

Required

New password for the account

Request Body

Password reset details

{
  "email": "user@example.com",
  "resetCode": "ABC123",
  "newPassword": "newsecurepassword123"
}

Response

true

Password reset success status

POST

/api/portal/users/two-factor/authenticator/begin

Auth Required

Returns a candidate TOTP secret and its otpauth URI for the QR code. Nothing is written to the account until it is confirmed, so abandoning the setup changes nothing. Identity's own /manage/2fa is deliberately unavailable here, because it strips two-factor and returns the shared key on nothing more than a bearer token.

Response

{
  "value": {
    "base32Secret": "JBSWY3DPEHPK3PXP",
    "otpauthUri": "otpauth://totp/Rent%20a%20Mac%3Ayou%40example.com?secret=JBSWY3DPEHPK3PXP&issuer=Rent%20a%20Mac&digits=6&period=30"
  },
  "isSuccess": true
}

The pending secret expires after 10 minutes

This endpoint requires authentication. Include the Bearer token in the Authorization header.

POST

/api/portal/users/two-factor/authenticator/confirm

Auth Required

Verifies a code from the pending secret, then persists it and turns on 2FA. Returns the one-time recovery codes, which are never retrievable again. This rotates the security stamp, so existing refresh tokens stop working and the client must sign in again.

Parameters

code

string

body

Required

The 6-digit code from the authenticator app

Request Body

A code generated from the secret returned by the begin call

{
  "code": "123456"
}

Response

{
  "value": ["a1b2c-3d4e5", "f6g7h-8i9j0"],
  "isSuccess": true
}

The recovery codes, shown only once

This endpoint requires authentication. Include the Bearer token in the Authorization header.

GET

/api/portal/users/two-factor

Auth Required

Whether 2FA is on, which method is in use, and how many recovery codes remain

Response

{
  "enabled": true,
  "method": "authenticator",
  "recoveryCodesLeft": 10
}

method is "authenticator" or "email"; null when 2FA is off

This endpoint requires authentication. Include the Bearer token in the Authorization header.

POST

/api/portal/users/two-factor/email/begin

Auth Required

Emails a 6-digit code to the account address. Use the authenticator/begin endpoint instead for an authenticator app.

Response

{
  "isSuccess": true,
  "successMessage": "We sent a 6-digit code to you@example.com."
}

Subject to a 60 second resend cooldown

This endpoint requires authentication. Include the Bearer token in the Authorization header.

POST

/api/portal/users/two-factor/email/confirm

Auth Required

Verifies the emailed code and turns on 2FA. This rotates the security stamp, so existing refresh tokens stop working and the client must sign in again.

Parameters

code

string

body

Required

The 6-digit code that was emailed

Request Body

The code from the enrollment email

{
  "code": "123456"
}

Response

{
  "isSuccess": true,
  "successMessage": "Two-factor authentication is on. Please sign in again."
}

2FA enrollment result

This endpoint requires authentication. Include the Bearer token in the Authorization header.

POST

/api/portal/users/two-factor/send-code

Auth Required

Emails a code to a signed-in user, for confirming a change to their 2FA settings

Response

{
  "isSuccess": true,
  "successMessage": "We sent a 6-digit code to you@example.com."
}

Subject to a 60 second resend cooldown

This endpoint requires authentication. Include the Bearer token in the Authorization header.

POST

/api/portal/users/two-factor/disable

Auth Required

Turns 2FA off. Requires a current second factor, so a stolen session cannot strip the protection. Rotates the security stamp, so the client must sign in again.

Parameters

code

string

body

Required

A currently valid second factor

Request Body

An authenticator code, an emailed code, or a recovery code

{
  "code": "123456"
}

Response

{
  "isSuccess": true,
  "successMessage": "Two-factor authentication is off."
}

2FA removal result

This endpoint requires authentication. Include the Bearer token in the Authorization header.

POST

/api/portal/auth/two-factor/send-code

Unauthenticated: takes the credentials again to email a code, either as the resend for the email method or as the fallback for a user who cannot reach their authenticator app. Always answers identically, so it reveals nothing about the account.

Parameters

email

string

body

Required

Account email address

password

string

body

Required

Account password

Request Body

The same credentials just submitted to /login

{
  "email": "you@example.com",
  "password": "your-password"
}

Response

{
  "isSuccess": true,
  "successMessage": "If that account needs a code, we have emailed one."
}

Always a success, whatever the outcome

POST

/manage/info

Auth Required

Change the account password. To change the email address use the /api/portal/users/email-change endpoints instead, which verify the new address with a code.

Parameters

newPassword

string

body

Required

New password

oldPassword

string

body

Required

Current password

Request Body

Password change details

{
  "newPassword": "newpassword123",
  "oldPassword": "currentpassword"
}

Response

{
  "email": "user@example.com",
  "isEmailConfirmed": true
}

Updated user information

This endpoint requires authentication. Include the Bearer token in the Authorization header.

GET

/api/portal/users/email-change/requirements

Auth Required

Which proof of identity this account must give before changing its email: "twoFactorCode" when 2FA is on, otherwise "password", otherwise (Google sign-in only accounts) "emailCode", a code sent to the current address.

Response

{
  "challenge": "password"
}

challenge is "twoFactorCode", "password" or "emailCode"

This endpoint requires authentication. Include the Bearer token in the Authorization header.

POST

/api/portal/users/email-change/send-identity-code

Auth Required

Emails a 6-digit code to the current address. Only for accounts whose challenge is "emailCode"; others are refused.

Response

{
  "isSuccess": true,
  "successMessage": "We sent a 6-digit code to you@example.com."
}

Subject to a 60 second resend cooldown

This endpoint requires authentication. Include the Bearer token in the Authorization header.

POST

/api/portal/users/email-change/request

Auth Required

Verifies your identity, then emails a 6-digit code to the NEW address. Nothing changes until the code is confirmed. The code expires after 15 minutes.

Parameters

newEmail

string

body

Required

The address to switch to; must not belong to another account

password

string

body

Optional

Current password, when the challenge is "password"

code

string

body

Optional

A second factor (challenge "twoFactorCode") or the code sent to the current address (challenge "emailCode")

Request Body

The new address plus the proof named by the requirements endpoint

{
  "newEmail": "new@example.com",
  "password": "currentpassword",
  "code": null
}

Response

{
  "isSuccess": true,
  "successMessage": "We sent a 6-digit code to new@example.com. Enter it to confirm the change."
}

Subject to a 60 second resend cooldown

This endpoint requires authentication. Include the Bearer token in the Authorization header.

POST

/api/portal/users/email-change/confirm

Auth Required

Applies the change with the code emailed to the new address. Five wrong attempts cancel the request. Afterwards the current access token is stale, so sign in again with the new email.

Parameters

code

string

body

Required

The 6-digit code

Request Body

The code sent to the new address

{
  "code": "123456"
}

Response

{
  "isSuccess": true,
  "successMessage": "Your email has been changed. Please sign in again with your new email."
}

Email change result

This endpoint requires authentication. Include the Bearer token in the Authorization header.

Loading API documentation...

{ "value": { "base32Secret": "JBSWY3DPEHPK3PXP", "otpauthUri": "otpauth://totp/Rent%20a%20Mac%3Ayou%40example.com?secret=JBSWY3DPEHPK3PXP&issuer=Rent%20a%20Mac&digits=6&period=30" }, "isSuccess": true }