Is there a programmatic API for system integration?

[TyIsI]

Example scenario:

There is an existing user/billing management system and I'm exploring user authentication systems that can provide SSO type services.

As billing generates users, would it be possible to programmatically create/invite users over an API? Or would that need to be done through a database connection?

[paulodearaujo]

Current VoidAuth has an admin JSON endpoint for invitations, but it is not yet a service-to-service API.

The web admin UI calls POST /api/admin/invitation (client code). The server creates the invitation, challenge, expiry, and group links and returns the invitation details (route). There is also POST /api/admin/send_invitation/:id when VoidAuth should send the email.

The limitation for your billing integration is authentication: every admin route is protected by checkPrivileged and checkAdmin and expects a logged-in VoidAuth user session, not an API token or OAuth client-credentials grant (router guard). Calling the endpoint with an admin browser session would technically work, but I would not build an integration around that cookie because it is not a stable machine-auth contract.

Direct user creation is deliberately not the model today. The docs say users can only be invited, so they choose their password when accepting the invitation (user management). I would also avoid writing to the database directly; that would bypass the invitation challenge, expiration, group links, audit fields, and email flow.

So the practical answer is:

• interactive/admin automation: the existing invitation endpoint can do it;
• reliable system integration: VoidAuth still needs a documented admin token or service-account authentication method for that endpoint;
• direct database writes: not recommended.

A narrowly scoped API token that can only create/list/revoke invitations would fit this use case without granting a billing system a reusable human admin session.