App shell navigation data
Returns navbar links, pending access request notifications, and locked user alerts for the authenticated user. Used by the SPA app shell on every page load after authentication.
Authorizations
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Responses
Navigation data for app shell
Public pre-auth UI configuration
Returns application settings needed before authentication: banner, consent modal, auth provider flags, password policy, and registration status. No authentication required — the login page and consent banner need this data before the user signs in.
Responses
Public settings for SPA pre-auth UI
Application version and metadata
Returns the application name, version, Rails version, Ruby version, and environment. No authentication required — used by monitoring tools, deployment verification scripts, and the frontend health check.
Responses
Version and runtime metadata
Acknowledge consent banner (AC-8)
Records the user's acknowledgment of the system consent banner in the Rails session. Required by NIST AC-8 before interacting with the application. Does not require authentication — the consent modal appears before login.
Responses
Consent acknowledged (timestamp stored in session)