Read the password policy
GET/auth/password-policy
No token. One of the calls you make before you have one. Send X-Tenant-Code where the operation lists it — that is which tenant you are asking about, not proof of who you are.
The rules a password must satisfy, so you can validate before submitting and word the hint yourself.
Read it once at startup and cache it. These are the same rules the server enforces on every password it accepts, so client-side validation here will never disagree with the server's answer. Unauthenticated — the policy is not a secret.
Responses
- 200
- 400
- 401
- 403
- 404
- 500
OK
Malformed request — validation failure, or a header such as Idempotency-Key is missing or not a UUID.
Missing, expired, or untrusted bearer token.
Authenticated but not permitted — the caller's role or scope does not grant this operation, or the resource belongs to another tenant.
The referenced wallet, transaction, user, or tenant does not exist within the caller's tenant.
Unexpected server error.