Account API /api/account
Account management endpoints. All require a session token.
GET /api/account
Returns the account overview and statistics.
json
{
"ok": true,
"user": { "id": "1", "email": "you@example.com", "displayName": "You", "avatarUrl": "/uploads/avatars/1-abc.png", "credits": 992, "emailVerified": true, "createdAt": "..." },
"stats": { "activeSessions": 2, "signInCount": 14 }
}PUT /api/account/profile
Updates the display name.
| Parameter | Type | Required | Description |
|---|---|---|---|
displayName | string | No | Up to 60 characters; an empty string clears the name |
Names over the limit return 400 name_too_long.
POST /api/account/avatar
Uploads an avatar.
| Parameter | Type | Required | Description |
|---|---|---|---|
image | string | Yes | Base64 data URI; PNG, JPG or WebP, no larger than 400 KB after decoding |
Before uploading, the console uses a canvas to center-crop the image to a square and resize it to 256×256. The server validates and saves the image. A successful upload deletes the previous avatar.
json
{ "ok": true, "user": { "...": "...", "avatarUrl": "/uploads/avatars/1-abc.png" } }Unsupported formats or oversized images return 400 invalid_image.
DELETE /api/account/avatar
Deletes the avatar. The interface falls back to the initial of the display name.
POST /api/account/password
Changes the password.
| Parameter | Type | Required | Description |
|---|---|---|---|
currentPassword | string | Yes | Current password |
newPassword | string | Yes | 8–72 characters, including letters and digits |
- An incorrect current password returns
400 wrong_current_password. - Reusing the current password returns
400 same_password. - After a successful change, all sessions except the current device's session are invalidated immediately.
GET /api/account/sessions
Lists signed-in devices.
json
{
"ok": true,
"sessions": [
{ "id": "12", "current": true, "userAgent": "Mozilla/5.0 ...", "ip": "1.2.3.4", "createdAt": "...", "expiresAt": "..." }
]
}DELETE /api/account/sessions/:id
Signs out a specific device.
- Passing the current session's ID returns
400 current_session. Use logout instead. - An ID belonging to another user returns
404 not_found.
DELETE /api/account/sessions
Signs out all devices except the current one.
json
{ "ok": true, "revoked": 3 }