Accounts

Endpoint	What it does
POST /accounts	Register an account id derived on the device from a recovery phrase. Takes accountId, authVerifier and authPublicKey. Returns the account with a session token and expiresAt. The phrase is never sent.
POST /accounts/challenge	Send an accountId. Returns a single-use nonce, its expiresAt two minutes out, and an ephemeral X25519 challengeKey. The answer is the same whether or not the account exists.
POST /accounts/verify	Send accountId, nonce and proof. Returns the account with a session token and expiresAt. See Authentication.
GET /accounts/me	The authenticated account and its plan.
POST /accounts/signout	End the current session. Session only.
GET /accounts/sessions	The account’s live sessions, with the current one marked. Session only.
DELETE /accounts/sessions	End every session except the current one. Session only.
DELETE /accounts/sessions/:id	End one session. Session only.
DELETE /accounts/me	Erase the account and everything in it, immediately. Its addresses are retired and never reissued. Session only.
GET /overview	Account counters for the dashboard.
GET /activity	Recent account activity, up to limit entries (default 20, at most 200).

“Session only” endpoints answer 403 session_required to an API key.