# Overview

## Identity

Tenant-scoped identity directory (list, get, list-active-sessions, revoke-sessions, whoami) — part of the admin control plane. Caller-plugged via `IdentityDirectoryBinding` — deployments plug in their own user store (LDAP, SCIM, or bespoke). Registry-only over HTTP: the framework does NOT own user persistence. The directory is flat; groups, roles, invitations, directory sync and impersonation are not part of this surface. `primaryEmail` may be redacted per tenant policy — the routes treat it as opaque. Provider access-token / refresh-token NEVER cross the wire, even to admins.

## Operations

GET

[/v1/identity/users](https://docs.kindgi.com/v0.1.9/reference/api/operations/identityuserslist.md)

POST

[/v1/identity/users](https://docs.kindgi.com/v0.1.9/reference/api/operations/identityuserscreate.md)

GET

[/v1/identity/users/{userId}](https://docs.kindgi.com/v0.1.9/reference/api/operations/identityusersget.md)

GET

[/v1/identity/users/{userId}/sessions](https://docs.kindgi.com/v0.1.9/reference/api/operations/identityuserslistsessions.md)

POST

[/v1/identity/users/{userId}/unregister](https://docs.kindgi.com/v0.1.9/reference/api/operations/identityusersunregister.md)

POST

[/v1/identity/users/{userId}/invite](https://docs.kindgi.com/v0.1.9/reference/api/operations/identityusersresendinvite.md)

GET

[/v1/identity/me/second-factor](https://docs.kindgi.com/v0.1.9/reference/api/operations/identitymesecondfactor.md)

POST

[/v1/identity/me/second-factor](https://docs.kindgi.com/v0.1.9/reference/api/operations/identitymestartsecondfactor.md)

POST

[/v1/identity/me/second-factor/confirm](https://docs.kindgi.com/v0.1.9/reference/api/operations/identitymeconfirmsecondfactor.md)

POST

[/v1/identity/me/second-factor/recovery-codes](https://docs.kindgi.com/v0.1.9/reference/api/operations/identitymenewrecoverycodes.md)

POST

[/v1/identity/me/second-factor/remove](https://docs.kindgi.com/v0.1.9/reference/api/operations/identitymeremovesecondfactor.md)

GET

[/v1/identity/users/{userId}/second-factor](https://docs.kindgi.com/v0.1.9/reference/api/operations/identityuserssecondfactor.md)

POST

[/v1/identity/users/{userId}/second-factor/remove](https://docs.kindgi.com/v0.1.9/reference/api/operations/identityusersremovesecondfactor.md)

POST

[/v1/identity/users/{userId}/revoke-sessions](https://docs.kindgi.com/v0.1.9/reference/api/operations/identityusersrevokesessions.md)

GET

[/v1/identity/me/permissions](https://docs.kindgi.com/v0.1.9/reference/api/operations/identitymepermissions.md)

GET

[/v1/identity/users/{userId}/grants](https://docs.kindgi.com/v0.1.9/reference/api/operations/identityusersgrants.md)

POST

[/v1/identity/users/{userId}/grant](https://docs.kindgi.com/v0.1.9/reference/api/operations/identityusersgrant.md)

POST

[/v1/identity/users/{userId}/ungrant](https://docs.kindgi.com/v0.1.9/reference/api/operations/identityusersungrant.md)

GET

[/v1/identity/whoami](https://docs.kindgi.com/v0.1.9/reference/api/operations/identitywhoami.md)