OpenAPI v3 Auto-GeneratedBase: https://api.nineauth.xyz

Runtime API Reference

The Runtime API is optimized for high-throughput, low-latency client calls from native desktop applications. Authenticate requests using the x-api-key header with your public key (app_pub_live_*).

POST/v1/runtime/applications/init

API Key (Bearer)Stable

Initializes and returns public configuration for the application

Name	Type	Location	Description
x-application-id*	string	header	Application UUID
x-environment	string	header	Parameter in header

Response Codes & Examples

200Default Response

{
  "application_id": "8f8b3c91-42ab-4de0-84a1-8d2a1b9201f1",
  "name": "string_value",
  "environment": "string_value"
}

400Default Response

{
  "error": "{\n  \"code\": \"string_value\",\n  \"message\": \"string_value\"\n}"
}

Interactive Code Examples

// Call POST /v1/runtime/applications/init
const response = await fetch("https://api.nineauth.xyz/v1/runtime/applications/init", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "x-api-key": process.env.NINEAUTH_API_KEY,
  },
});
const data = await response.json();

POST/v1/runtime/auth/register

API Key (Bearer)Stable

Registers a new end-user for the specified application

Request Body (JSON)

{
  "email": "user@example.com",
  "password": "SuperSecurePassword123!"
}

Response Codes & Examples

201Default Response

{
  "user_id": "8f8b3c91-42ab-4de0-84a1-8d2a1b9201f1"
}

400Default Response

{
  "error": "{\n  \"code\": \"string_value\",\n  \"message\": \"string_value\"\n}"
}

409Default Response

{
  "error": "{\n  \"code\": \"string_value\",\n  \"message\": \"string_value\"\n}"
}

429Default Response

{
  "error": "{\n  \"code\": \"string_value\",\n  \"message\": \"string_value\"\n}"
}

Interactive Code Examples

// Call POST /v1/runtime/auth/register
const response = await fetch("https://api.nineauth.xyz/v1/runtime/auth/register", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "x-api-key": process.env.NINEAUTH_API_KEY,
  },
  body: JSON.stringify({
  "email": "user@example.com",
  "password": "SuperSecurePassword123!"
}),
});
const data = await response.json();

POST/v1/runtime/auth/login

API Key (Bearer)Stable

Authenticates an end-user and issues access & refresh tokens with anti-replay protection

Request Body (JSON)

{
  "email": "user@example.com",
  "password": "SuperSecurePassword123!",
  "device_fingerprint": "string_value",
  "timestamp": "2026-08-22T23:30:00Z",
  "nonce": "string_value"
}

Response Codes & Examples

200Default Response

{
  "access_token": "tok_live_9f8a3b10...",
  "refresh_token": "tok_live_9f8a3b10...",
  "access_expires_at": "string_value",
  "refresh_expires_at": "string_value"
}

400Default Response

{
  "error": "{\n  \"code\": \"string_value\",\n  \"message\": \"string_value\"\n}"
}

401Default Response

{
  "error": "{\n  \"code\": \"string_value\",\n  \"message\": \"string_value\"\n}"
}

403Default Response

{
  "error": "{\n  \"code\": \"string_value\",\n  \"message\": \"string_value\"\n}"
}

409Default Response

{
  "error": "{\n  \"code\": \"string_value\",\n  \"message\": \"string_value\"\n}"
}

429Default Response

{
  "error": "{\n  \"code\": \"string_value\",\n  \"message\": \"string_value\"\n}"
}

Interactive Code Examples

// Call POST /v1/runtime/auth/login
const response = await fetch("https://api.nineauth.xyz/v1/runtime/auth/login", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "x-api-key": process.env.NINEAUTH_API_KEY,
  },
  body: JSON.stringify({
  "email": "user@example.com",
  "password": "SuperSecurePassword123!",
  "device_fingerprint": "string_value",
  "timestamp": "2026-08-22T23:30:00Z",
  "nonce": "string_value"
}),
});
const data = await response.json();

POST/v1/runtime/auth/logout

API Key (Bearer)Stable

Revokes the active session associated with the provided access token

Request Body (JSON)

{
  "access_token": "tok_live_9f8a3b10..."
}

Response Codes & Examples

200Default Response

{
  "success": true
}

Interactive Code Examples

// Call POST /v1/runtime/auth/logout
const response = await fetch("https://api.nineauth.xyz/v1/runtime/auth/logout", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "x-api-key": process.env.NINEAUTH_API_KEY,
  },
  body: JSON.stringify({
  "access_token": "tok_live_9f8a3b10..."
}),
});
const data = await response.json();

POST/v1/runtime/licenses/activate

API Key (Bearer)Stable

Activates a license key for a specific device and returns a session with entitlements (anti-replay protected)

Request Body (JSON)

{
  "license_key": "NINE-PRO-8891-2294-XXXX",
  "device_fingerprint": "string_value",
  "timestamp": "2026-08-22T23:30:00Z",
  "nonce": "string_value"
}

Response Codes & Examples

200Default Response

{
  "access_token": "tok_live_9f8a3b10...",
  "refresh_token": "tok_live_9f8a3b10...",
  "access_expires_at": "string_value",
  "refresh_expires_at": "string_value",
  "entitlements": [
    "item_1",
    "item_2"
  ],
  "license": "{\n  \"status\": \"string_value\",\n  \"expires_at\": \"string_value\"\n}"
}

400Default Response

{
  "error": "{\n  \"code\": \"string_value\",\n  \"message\": \"string_value\"\n}"
}

403Default Response

{
  "error": "{\n  \"code\": \"string_value\",\n  \"message\": \"string_value\"\n}"
}

404Default Response

{
  "error": "{\n  \"code\": \"string_value\",\n  \"message\": \"string_value\"\n}"
}

409Default Response

{
  "error": "{\n  \"code\": \"string_value\",\n  \"message\": \"string_value\"\n}"
}

429Default Response

{
  "error": "{\n  \"code\": \"string_value\",\n  \"message\": \"string_value\"\n}"
}

Interactive Code Examples

// Call POST /v1/runtime/licenses/activate
const response = await fetch("https://api.nineauth.xyz/v1/runtime/licenses/activate", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "x-api-key": process.env.NINEAUTH_API_KEY,
  },
  body: JSON.stringify({
  "license_key": "NINE-PRO-8891-2294-XXXX",
  "device_fingerprint": "string_value",
  "timestamp": "2026-08-22T23:30:00Z",
  "nonce": "string_value"
}),
});
const data = await response.json();

POST/v1/runtime/sessions/validate

API Key (Bearer)Stable

Validates an active session token with cascade status verification

Request Body (JSON)

{
  "access_token": "tok_live_9f8a3b10..."
}

Response Codes & Examples

200Default Response

{
  "anyOf": [
    {
      "type": "object",
      "properties": {
        "valid": {
          "type": "boolean",
          "enum": [
            true
          ]
        },
        "entitlements": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "expires_at": {
          "type": "string"
        }
      },
      "required": [
        "valid",
        "entitlements",
        "expires_at"
      ],
      "additionalProperties": false
    },
    {
      "type": "object",
      "properties": {
        "valid": {
          "type": "boolean",
          "enum": [
            false
          ]
        },
        "reason": {
          "type": "string"
        }
      },
      "required": [
        "valid",
        "reason"
      ],
      "additionalProperties": false
    }
  ]
}

Interactive Code Examples

// Call POST /v1/runtime/sessions/validate
const response = await fetch("https://api.nineauth.xyz/v1/runtime/sessions/validate", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "x-api-key": process.env.NINEAUTH_API_KEY,
  },
  body: JSON.stringify({
  "access_token": "tok_live_9f8a3b10..."
}),
});
const data = await response.json();

POST/v1/runtime/sessions/refresh

API Key (Bearer)Stable

Refreshes an active session and issues a new pair of access & refresh tokens

Request Body (JSON)

{
  "refresh_token": "tok_live_9f8a3b10..."
}

Response Codes & Examples

200Default Response

{
  "access_token": "tok_live_9f8a3b10...",
  "refresh_token": "tok_live_9f8a3b10...",
  "access_expires_at": "string_value",
  "refresh_expires_at": "string_value"
}

400Default Response

{
  "error": "{\n  \"code\": \"string_value\",\n  \"message\": \"string_value\"\n}"
}

401Default Response

{
  "error": "{\n  \"code\": \"string_value\",\n  \"message\": \"string_value\"\n}"
}

Interactive Code Examples

// Call POST /v1/runtime/sessions/refresh
const response = await fetch("https://api.nineauth.xyz/v1/runtime/sessions/refresh", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "x-api-key": process.env.NINEAUTH_API_KEY,
  },
  body: JSON.stringify({
  "refresh_token": "tok_live_9f8a3b10..."
}),
});
const data = await response.json();

GET/v1/runtime/entitlements/check

API Key (Bearer)Stable

Checks if an active session is granted a specific entitlement key. Requires Bearer access token in Authorization header.

Name	Type	Location	Description
key*	string	query	The entitlement key to check

Response Codes & Examples

200Default Response

{
  "granted": true
}

401Default Response

{
  "error": "{\n  \"code\": \"string_value\",\n  \"message\": \"string_value\"\n}"
}

Interactive Code Examples

// Call GET /v1/runtime/entitlements/check
const response = await fetch("https://api.nineauth.xyz/v1/runtime/entitlements/check", {
  method: "GET",
  headers: {
    "Content-Type": "application/json",
    "x-api-key": process.env.NINEAUTH_API_KEY,
  },
});
const data = await response.json();

POST/v1/runtime/devices/reset

API Key (Bearer)Stable

Self-service HWID device reset using a valid license key

Request Body (JSON)

{
  "license_key": "NINE-PRO-8891-2294-XXXX",
  "device_fingerprint": "string_value"
}

Response Codes & Examples

200Default Response

{
  "success": true,
  "device_resets_remaining": 1
}

400Default Response

{
  "error": "{\n  \"code\": \"string_value\",\n  \"message\": \"string_value\"\n}"
}

403Default Response

{
  "error": "{\n  \"code\": \"string_value\",\n  \"message\": \"string_value\"\n}"
}

404Default Response

{
  "error": "{\n  \"code\": \"string_value\",\n  \"message\": \"string_value\"\n}"
}

429Default Response

{
  "error": "{\n  \"code\": \"string_value\",\n  \"message\": \"string_value\"\n}"
}

Interactive Code Examples

// Call POST /v1/runtime/devices/reset
const response = await fetch("https://api.nineauth.xyz/v1/runtime/devices/reset", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "x-api-key": process.env.NINEAUTH_API_KEY,
  },
  body: JSON.stringify({
  "license_key": "NINE-PRO-8891-2294-XXXX",
  "device_fingerprint": "string_value"
}),
});
const data = await response.json();