Authentication

Signing in, tokens, and account creation.

7 endpoints · base URL https://api.aerscheduler.com

get/auth

Get the current session

Returns the signed-in user, their active organization, and a refreshed token.

Responses

`200`	OK	The current session.
`401`	Unauthorized	No token, an expired token, or a malformed one. Sign in again.
`403`	Forbidden	Authenticated, but not allowed to do this.
`429`	Too Many Requests	Rate limited. `Retry-After` says how long to wait.

Example request

curl https://api.aerscheduler.com/auth \
  -H "Authorization: Bearer $AERSCHEDULER_TOKEN"

post/authNo auth required

Sign in

Exchanges an email and password for a bearer token valid for 30 days. Send that token as Authorization: Bearer <token> on every other request.

The token is scoped to one organization — whichever is active for the account. If the account belongs to several, switch with POST /organizations/switch/{orgId}, which returns a fresh token scoped to the new one.

Request body

Credentials.

`email`required	`string`
`password`required	`string`

Responses

`200`	OK	Signed in.
`401`	Unauthorized	Invalid email or password. Deliberately identical whether or not the account exists.
`429`	Too Many Requests	Too many sign-in attempts. Limited per IP and per email address.

Example request

curl -X POST https://api.aerscheduler.com/auth \
  -H "Authorization: Bearer $AERSCHEDULER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"email":"you@yourschool.com","password":"…"}'

delete/auth

Sign out a device

Removes a push-notification device token. Bearer tokens are stateless and are not revoked by this call.

Request body

The device token to forget.

token string

Responses

`204`	No Content	Success. No body.
`401`	Unauthorized	No token, an expired token, or a malformed one. Sign in again.
`403`	Forbidden	Authenticated, but not allowed to do this.
`429`	Too Many Requests	Rate limited. `Retry-After` says how long to wait.

Example request

curl -X DELETE https://api.aerscheduler.com/auth \
  -H "Authorization: Bearer $AERSCHEDULER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"token":"…"}'

post/usersNo auth required

Create an account

Registers a person and returns a token immediately. A verification email is sent; some endpoints stay closed until the address is verified.

Request body

The new account.

`name`required	`string`
`email`required	`string`
`password`required	`string`

Responses

`201`	Created	Account created.
`400`	Bad Request	The address is already registered, or the password is too weak.
`429`	Too Many Requests	Too many sign-ups from this address.

Example request

curl -X POST https://api.aerscheduler.com/users \
  -H "Authorization: Bearer $AERSCHEDULER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"…","email":"you@yourschool.com","password":"…"}'

post/auth/forgot-passwordNo auth required

Request a password reset

Emails a reset link. Always answers 204, whether or not the address exists — telling the caller which addresses are registered would be an account-enumeration hole.

Request body

The address to send to.

emailrequired string

Responses

`204`	No Content	Accepted.
`400`	Bad Request	No email supplied.
`429`	Too Many Requests	Too many requests.

Example request

curl -X POST https://api.aerscheduler.com/auth/forgot-password \
  -H "Authorization: Bearer $AERSCHEDULER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"email":"you@yourschool.com"}'

post/auth/reset-passwordNo auth required

Redeem a password reset token

Sets a new password using the token from the reset email.

Request body

The token and the new password.

`token`required	`string`
`password`required	`string`

Responses

`204`	No Content	Password changed.
`400`	Bad Request	The link has expired or the token is invalid.

Example request

curl -X POST https://api.aerscheduler.com/auth/reset-password \
  -H "Authorization: Bearer $AERSCHEDULER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"token":"…","password":"…"}'

get/auth/session

Check whether a token is still valid

A cheap liveness probe for a stored token. Answers 200 if the token is good and 401 if it is not — nothing else. Use it to decide whether to prompt for sign-in without making a real request.

Responses

`200`	OK	The token is valid.
`401`	Unauthorized	The token is expired or invalid.

Example request

curl https://api.aerscheduler.com/auth/session \
  -H "Authorization: Bearer $AERSCHEDULER_TOKEN"

NextOrganizationsThe flight school itself: membership, invitations, and settings.