Adjoint Docs Product ↗
Menu

Account

Your own profile, password, and active sessions — the same surface for admins and developers; there's no separate "admin account" API. See Account and sessions for the CLI-level walkthrough of these routes.

All routes on this page are bearer-scoped: any authenticated member can call them for their own account, and only their own.

GET /v1/account — view your profile

$ curl -s https://api.stagdb.com/v1/account -H "Authorization: Bearer $TOKEN"

Response 200 OK

{
  "id": "3e6f0a2b-7c8d-4e1f-9a2b-3c4d5e6f7a8b",
  "email": "[email protected]",
  "display_name": "Dana Lin",
  "role": "user",
  "status": "active",
  "org_id": "1c9c14da-8b0e-4c6e-9f1a-2d7c3a5b6e42",
  "org_slug": "acme",
  "created_at": "2026-06-02T14:03:11Z"
}
Status When
401 Missing/invalid/expired bearer token.

PATCH /v1/account — set your display name

Request body

Field Type Required
display_name string yes 
$ curl -s https://api.stagdb.com/v1/account -X PATCH -H "Authorization: Bearer $TOKEN" \
    -H 'Content-Type: application/json' -d '{"display_name":"Dana Lin"}'

Response 200 OK — same shape as GET /v1/account, reflecting the new name.

Status When
400 Malformed JSON body.
401 Missing/invalid/expired bearer token.

POST /v1/account/password — change your password

Request body

Field Type Required Notes
current_password string yes Verified before the change is applied.
new_password string yes Minimum 8 characters.
refresh_token string no Keep-alive. If provided (and valid), the session tied to this refresh token survives the change; every other session for the account is revoked. Omit it and all sessions are revoked, including the one making this call. 
$ curl -s https://api.stagdb.com/v1/account/password -X POST -H "Authorization: Bearer $TOKEN" \
    -H 'Content-Type: application/json' \
    -d '{"current_password":"hunter22","new_password":"correcthorsebattery","refresh_token":"3n8fK2pQZmR1sV6xY0bC4dE7gH9jL_wA5oT8uI2rP0k"}'

Response: 204 No Content.

This is the mechanic behind adj account set-password staying logged in on the machine where you ran it while signing every other session out — the CLI always passes its own local refresh_token as the keep-alive.

Status When
400 Malformed JSON, or new_password under 8 characters.
401 Missing/invalid/expired bearer token, or current_password doesn't match.

GET /v1/account/sessions — list your active sessions

Header: X-Adj-Refresh-Hash (optional) — the SHA-256 hash of your current refresh token, hex-encoded. When present, the matching session in the response is marked "current": true; omit it and every session comes back with "current": false. The CLI always sends it (it already holds the raw refresh token locally and hashes it client-side — the raw token itself is never sent in a header).

$ curl -s https://api.stagdb.com/v1/account/sessions \
    -H "Authorization: Bearer $TOKEN" \
    -H "X-Adj-Refresh-Hash: 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a5"

Response 200 OK

{
  "sessions": [
    {"id": "9c2f7e51-d4a8-4b36-8f1e-8d2c5a9b4370", "issued_at": "2026-07-10T09:12:00Z", "expires_at": "2026-08-09T09:12:00Z", "current": true},
    {"id": "6e1f8a25-d3b7-4c90-8e4f-6a1d82b5c3e7", "issued_at": "2026-06-28T16:40:00Z", "expires_at": "2026-07-28T16:40:00Z", "current": false}
  ]
}

Each entry is a live (unexpired, unrevoked) refresh token, identified by its own id — never the raw token value, which is never stored or returned after issuance.

Status When
401 Missing/invalid/expired bearer token.

DELETE /v1/account/sessions — sign out everywhere

Revokes every refresh token for your account, including the one you're currently using — this is adj logout --all.

$ curl -s https://api.stagdb.com/v1/account/sessions -X DELETE -H "Authorization: Bearer $TOKEN" -o /dev/null -w '%{http_code}\n'
204

Response: 204 No Content.

Status When
401 Missing/invalid/expired bearer token.

Next