HonkIO Auth

Users

Users, their sessions and sign-in history, blocking and deleting, and exports.

List users

GET/v1/auth-apps/:id/users

Permission: auth_users: r

The app’s users.

Query parameters

Name	Type	Description
email	string	Only the user with this email address.
phone	string	Only the user with this phone number.
query	string	Search names, email addresses and phone numbers.
blocked	"true" \| "false"	Only blocked, or only unblocked, users.
likely_bot	"true" \| "false"	Only users flagged as likely bots, or only the others.
created_after	date-time	Only users created after this time (ISO 8601).
created_before	date-time	Only users created before this time (ISO 8601).
limit	integer	How many to return per page.
cursor	string	The `next_cursor` of the previous page.

Request

curl https://api.honkio.ca/v1/auth-apps/APP_ID/users \
  -H "Authorization: Bearer mk_test_YOUR_KEY"

Response · 200

{
  "data": [
    {
      "id": "usr_clxxxuserxxxxxxxxxxxxxx",
      "email": "ada@example.com",
      "email_verified": true,
      "phone": null,
      "phone_verified": false,
      "name": "Ada Lovelace",
      "blocked": false,
      "created_at": "2026-11-02T15:04:05.000Z",
      "last_sign_in_at": "2026-11-20T09:12:44.000Z",
      "metadata": {},
      "blocked_at": null,
      "blocked_reason": null,
      "likely_bot": false,
      "reverify_required": false
    }
  ],
  "next_cursor": null
}

Get a user

GET/v1/auth-apps/:id/users/:userId

Permission: auth_users: r

One user.

Request

curl https://api.honkio.ca/v1/auth-apps/APP_ID/users/USER_ID \
  -H "Authorization: Bearer mk_test_YOUR_KEY"

Response · 200

{
  "id": "usr_clxxxuserxxxxxxxxxxxxxx",
  "email": "ada@example.com",
  "email_verified": true,
  "phone": null,
  "phone_verified": false,
  "name": "Ada Lovelace",
  "blocked": false,
  "created_at": "2026-11-02T15:04:05.000Z",
  "last_sign_in_at": "2026-11-20T09:12:44.000Z",
  "metadata": {},
  "blocked_at": null,
  "blocked_reason": null,
  "likely_bot": false,
  "reverify_required": false
}

Update a user

PATCH/v1/auth-apps/:id/users/:userId

Permission: auth_users: m

Changes the fields you send. A new email or phone is notified at the old one and written to your audit log. Sends user.updated.

Body

Name	Type	Description
name	string \| null	The user’s name, in the `profile` scope.
email	string \| null	A new email address. The old one is notified.
email_verified	boolean	Mark the email address as verified or not.
phone	string \| null	A new Canadian mobile number, in E.164. The old one is notified.
phone_verified	boolean	Mark the phone number as verified or not.
metadata	object	Your own JSON object about the user. Never shown to them.
locale	"en" \| "fr"	The language of the notice sent to an old email address or number. Defaults to Accept-Language.

Request

curl -X PATCH https://api.honkio.ca/v1/auth-apps/APP_ID/users/USER_ID \
  -H "Authorization: Bearer mk_test_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Ada King"
  }'

Response · 200

{
  "id": "usr_clxxxuserxxxxxxxxxxxxxx",
  "email": "ada@example.com",
  "email_verified": true,
  "phone": null,
  "phone_verified": false,
  "name": "Ada King",
  "blocked": false,
  "created_at": "2026-11-02T15:04:05.000Z",
  "last_sign_in_at": "2026-11-20T09:12:44.000Z",
  "metadata": {},
  "blocked_at": null,
  "blocked_reason": null,
  "likely_bot": false,
  "reverify_required": false
}

Block a user

POST/v1/auth-apps/:id/users/:userId/block

Permission: auth_users: w

Ends all their sessions and stops them signing in. Sends user.blocked.

Body

Name	Type	Description
reason	string \| null	Why, for your records and the `user.blocked` event.

Request

curl -X POST https://api.honkio.ca/v1/auth-apps/APP_ID/users/USER_ID/block \
  -H "Authorization: Bearer mk_test_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "reason": "Chargeback fraud"
  }'

Response · 200

{
  "id": "usr_clxxxuserxxxxxxxxxxxxxx",
  "email": "ada@example.com",
  "email_verified": true,
  "phone": null,
  "phone_verified": false,
  "name": "Ada Lovelace",
  "blocked": true,
  "created_at": "2026-11-02T15:04:05.000Z",
  "last_sign_in_at": "2026-11-20T09:12:44.000Z",
  "metadata": {},
  "blocked_at": "2026-11-21T10:00:00.000Z",
  "blocked_reason": "Chargeback fraud",
  "likely_bot": false,
  "reverify_required": false
}

Unblock a user

POST/v1/auth-apps/:id/users/:userId/unblock

Permission: auth_users: w

Lets them sign in again.

Request

curl -X POST https://api.honkio.ca/v1/auth-apps/APP_ID/users/USER_ID/unblock \
  -H "Authorization: Bearer mk_test_YOUR_KEY"

Response · 200

{
  "id": "usr_clxxxuserxxxxxxxxxxxxxx",
  "email": "ada@example.com",
  "email_verified": true,
  "phone": null,
  "phone_verified": false,
  "name": "Ada Lovelace",
  "blocked": false,
  "created_at": "2026-11-02T15:04:05.000Z",
  "last_sign_in_at": "2026-11-20T09:12:44.000Z",
  "metadata": {},
  "blocked_at": null,
  "blocked_reason": null,
  "likely_bot": false,
  "reverify_required": false
}

Delete a user

DELETE/v1/auth-apps/:id/users/:userId

Permission: auth_users: d

Removes the user, their sessions and passkeys. Sends user.deleted.

Request

curl -X DELETE https://api.honkio.ca/v1/auth-apps/APP_ID/users/USER_ID \
  -H "Authorization: Bearer mk_test_YOUR_KEY"

204 · No content.

Delete likely bots

POST/v1/auth-apps/:id/users/bulk-delete

Permission: auth_users: w

Deletes users flagged as likely bots, in batches, and says how many. When more is true, call it again.

Body

Name	Type	Description
likely_botrequired	true	Must be `true`: only likely bots are deleted.
created_before	date-time	Only likely bots created before this time (ISO 8601).

Also needs a step-up token for auth_users:bulk_delete in the X-Step-Up-Token header.

Request

curl -X POST https://api.honkio.ca/v1/auth-apps/APP_ID/users/bulk-delete \
  -H "Authorization: Bearer mk_test_YOUR_KEY" \
  -H "X-Step-Up-Token: STEP_UP_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "likely_bot": true
  }'

Response · 200

{
  "deleted": 214,
  "more": false
}

List a user’s passkeys

GET/v1/auth-apps/:id/users/:userId/passkeys

Permission: auth_users: r

Public metadata of their passkeys, newest first. usable is false for a passkey made before passkey_scope changed.

Request

curl https://api.honkio.ca/v1/auth-apps/APP_ID/users/USER_ID/passkeys \
  -H "Authorization: Bearer mk_test_YOUR_KEY"

Response · 200

{
  "data": [
    {
      "id": "pk_xxxxxxxxxxxxxxxxxxxxxx",
      "user_id": "usr_clxxxuserxxxxxxxxxxxxxx",
      "name": "MacBook",
      "aaguid": null,
      "device_type": "multiDevice",
      "backed_up": true,
      "transports": [
        "internal",
        "hybrid"
      ],
      "rp_id": "acme.ca",
      "usable": true,
      "created_at": "2026-11-02T15:04:05.000Z",
      "last_used_at": "2026-11-02T15:04:05.000Z"
    }
  ]
}

Remove a user’s passkey

DELETE/v1/auth-apps/:id/users/:userId/passkeys/:passkeyId

Permission: auth_users: d

Deletes one passkey. The user is told at their email address, their sessions end, and user.updated is sent with changes: ["passkeys"].

Request

curl -X DELETE https://api.honkio.ca/v1/auth-apps/APP_ID/users/USER_ID/passkeys/PASSKEY_ID \
  -H "Authorization: Bearer mk_test_YOUR_KEY"

204 · No content.

List a user’s sessions

GET/v1/auth-apps/:id/users/:userId/sessions

Permission: auth_users: r

Their active sessions. Never a token.

Query parameters

Name	Type	Description
active	"true" \| "false"	Only active sessions, or only ended ones.
limit	integer	How many to return per page.
cursor	string	The `next_cursor` of the previous page.

Request

curl https://api.honkio.ca/v1/auth-apps/APP_ID/users/USER_ID/sessions \
  -H "Authorization: Bearer mk_test_YOUR_KEY"

Response · 200

{
  "data": [
    {
      "id": "ses_xxxxxxxxxxxxxxxxxxxxxx",
      "user_id": "usr_clxxxuserxxxxxxxxxxxxxx",
      "amr": [
        "otp"
      ],
      "organization_id": null,
      "created_at": "2026-11-02T15:04:05.000Z",
      "expires_at": "2026-12-02T15:04:05.000Z",
      "last_seen_at": "2026-11-20T09:12:44.000Z",
      "revoked_at": null,
      "revoke_reason": null,
      "active": true
    }
  ],
  "next_cursor": null
}

List a user’s sign-ins

GET/v1/auth-apps/:id/users/:userId/sign-ins

Permission: auth_users: r

One user’s sign-in attempts, newest first.

Query parameters

Name	Type	Description
limit	integer	How many to return per page.
cursor	string	The `next_cursor` of the previous page.

Request

curl https://api.honkio.ca/v1/auth-apps/APP_ID/users/USER_ID/sign-ins \
  -H "Authorization: Bearer mk_test_YOUR_KEY"

Response · 200

{
  "data": [
    {
      "id": "clxxxsigninxxxxxxxxxxxxxx",
      "user_id": "usr_clxxxuserxxxxxxxxxxxxxx",
      "method": "email",
      "outcome": "succeeded",
      "reason": null,
      "ip": "203.0.113.24",
      "network": "Example Telecom",
      "asn": 64500,
      "city": "Toronto",
      "region": "ON",
      "country": "CA",
      "device": "Firefox on macOS",
      "risk": "low",
      "flagged": false,
      "created_at": "2026-11-02T15:04:05.000Z"
    }
  ],
  "next_cursor": null
}

Revoke a session

DELETE/v1/auth-apps/:id/sessions/:sessionId

Permission: auth_users: d

Ends one session; its next refresh fails. Sends session.revoked with reason api.

Request

curl -X DELETE https://api.honkio.ca/v1/auth-apps/APP_ID/sessions/SESSION_ID \
  -H "Authorization: Bearer mk_test_YOUR_KEY"

204 · No content.

List sign-in history

GET/v1/auth-apps/:id/sign-ins

Permission: auth_users: r

Sign-in attempts from the last 90 days, newest first.

Query parameters

Name	Type	Description
user_id	string	Only this user’s sign-ins.
limit	integer	How many to return per page.
cursor	string	The `next_cursor` of the previous page.

Request

curl https://api.honkio.ca/v1/auth-apps/APP_ID/sign-ins \
  -H "Authorization: Bearer mk_test_YOUR_KEY"

Response · 200

{
  "data": [
    {
      "id": "clxxxsigninxxxxxxxxxxxxxx",
      "user_id": "usr_clxxxuserxxxxxxxxxxxxxx",
      "method": "email",
      "outcome": "succeeded",
      "reason": null,
      "ip": "203.0.113.24",
      "network": "Example Telecom",
      "asn": 64500,
      "city": "Toronto",
      "region": "ON",
      "country": "CA",
      "device": "Firefox on macOS",
      "risk": "low",
      "flagged": false,
      "created_at": "2026-11-02T15:04:05.000Z"
    }
  ],
  "next_cursor": null
}

Start an export

POST/v1/auth-apps/:id/exports

Permission: auth_users: w

Starts building a file of the app’s users, organizations, roles and passkey public metadata. The download link in this answer is shown only once; poll the export until it’s ready.

Also needs a step-up token for auth_users:export in the X-Step-Up-Token header.

Request

curl -X POST https://api.honkio.ca/v1/auth-apps/APP_ID/exports \
  -H "Authorization: Bearer mk_test_YOUR_KEY" \
  -H "X-Step-Up-Token: STEP_UP_TOKEN"

Response · 202

{
  "id": "clxxxexportxxxxxxxxxxxxxx",
  "status": "pending",
  "counts": null,
  "byte_size": null,
  "created_at": "2026-11-02T15:04:05.000Z",
  "ready_at": null,
  "expires_at": null,
  "downloaded_at": null,
  "download_url": "https://api.honkio.ca/v1/auth-exports/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

Get an export

GET/v1/auth-apps/:id/exports/:exportId

Permission: auth_users: r

Its status and counts. The file is ready to download, once and for 15 minutes, from the link the export’s creation returned.

Request

curl https://api.honkio.ca/v1/auth-apps/APP_ID/exports/EXPORT_ID \
  -H "Authorization: Bearer mk_test_YOUR_KEY"

Response · 200

{
  "id": "clxxxexportxxxxxxxxxxxxxx",
  "status": "ready",
  "counts": {
    "users": 1240,
    "passkeys": 402,
    "organizations": 12,
    "roles": 30,
    "memberships": 310
  },
  "byte_size": 482113,
  "created_at": "2026-11-02T15:04:05.000Z",
  "ready_at": "2026-11-02T15:04:35.000Z",
  "expires_at": "2026-11-02T15:19:35.000Z",
  "downloaded_at": null
}

Get the latest export

GET/v1/auth-apps/:id/exports/latest

Permission: auth_users: r

The app’s newest export, whatever its status. While it’s ready, the key that started it, sending a step-up token for auth_users:export in the X-Step-Up-Token header (the same step-up as starting an export), also gets a fresh single-use download_url; the earlier link stops working, and the new one expires with the export. Without that step-up, and for other keys, download_url is null and the earlier link keeps working.

Request

curl https://api.honkio.ca/v1/auth-apps/APP_ID/exports/latest \
  -H "Authorization: Bearer mk_test_YOUR_KEY"

Response · 200

{
  "id": "clxxxexportxxxxxxxxxxxxxx",
  "status": "ready",
  "counts": {
    "users": 1240,
    "passkeys": 402,
    "organizations": 12,
    "roles": 30,
    "memberships": 310
  },
  "byte_size": 482113,
  "created_at": "2026-11-02T15:04:05.000Z",
  "ready_at": "2026-11-02T15:04:35.000Z",
  "expires_at": "2026-11-02T15:19:35.000Z",
  "downloaded_at": null,
  "download_url": "https://api.honkio.ca/v1/auth-exports/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

Download an export

GET/v1/auth-exports/:token

Permission: None: the single-use link is the credential.

The file, as JSON. The link works once and expires 15 minutes after the export is ready. It never contains sessions, tokens, codes or keys.

Request

curl https://api.honkio.ca/v1/auth-exports/DOWNLOAD_TOKEN

Response · 200

{
  "app_id": "clxxxappxxxxxxxxxxxxxxxxx",
  "exported_at": "2026-11-02T15:04:05.000Z",
  "users": [
    {
      "id": "usr_clxxxuserxxxxxxxxxxxxxx",
      "email": "ada@example.com",
      "email_verified": true,
      "phone": null,
      "phone_verified": false,
      "name": "Ada Lovelace",
      "blocked": false,
      "created_at": "2026-11-02T15:04:05.000Z",
      "last_sign_in_at": "2026-11-20T09:12:44.000Z",
      "metadata": {},
      "blocked_at": null,
      "blocked_reason": null,
      "likely_bot": false,
      "reverify_required": false
    }
  ],
  "organizations": [
    {
      "id": "org_clxxxorgxxxxxxxxxxxxxxx",
      "name": "Northwind",
      "slug": "northwind",
      "two_step_required": false,
      "created_at": "2026-11-02T15:04:05.000Z"
    }
  ],
  "memberships": [
    {
      "organization_id": "org_clxxxorgxxxxxxxxxxxxxxx",
      "user_id": "usr_clxxxuserxxxxxxxxxxxxxx",
      "role": "admin",
      "last_used_at": null,
      "created_at": "2026-11-02T15:04:05.000Z",
      "updated_at": "2026-11-02T15:04:05.000Z"
    }
  ],
  "passkeys": [
    {
      "user_id": "usr_clxxxuserxxxxxxxxxxxxxx",
      "name": "MacBook",
      "created_at": "2026-11-02T15:04:05.000Z",
      "last_used_at": "2026-11-02T15:04:05.000Z"
    }
  ]
}