Authentication

The Praxis API uses JWT (JSON Web Tokens) for authentication. All API requests (except login/register) require a valid token.

Register a New Account (Admin Only)

POST /api/auth/register

This endpoint is restricted to administrators. Self-registration is disabled.

Request Body

{
  "email": "john@example.com",
  "password": "<enter-password>",
  "firstName": "John",
  "lastName": "Doe",
  "firmName": "Doe & Associates"  // optional
}

Response

{
  "token": "<redacted-login-token>",
  "user": {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "email": "john@example.com",
    "firstName": "John",
    "lastName": "Doe",
    "role": "admin",
    "firmId": "660e8400-e29b-41d4-a716-446655440001"
  },
  "firm": {
    "id": "660e8400-e29b-41d4-a716-446655440001",
    "name": "Doe & Associates",
    "subscriptionTier": "Essentials",
    "subscriptionExpiry": "2026-02-15T00:00:00Z"
  }
}

Login

POST /api/auth/login

Request Body

{
  "email": "john@example.com",
  "password": "<enter-password>"
}

Response

{
  "token": "<redacted-login-token>",
  "user": { ... },
  "firm": { ... }
}

Error Responses

Using the Token

Include the token in the Authorization header for all authenticated requests:

GET /api/cases HTTP/1.1
Host: web.praxislegal.be
Authorization: Bearer <access-token>

Example with cURL

curl -X GET "https://web.praxislegal.be/api/cases" \
  -H "Authorization: Bearer <access-token>"

Example with JavaScript

const response = await fetch('https://web.praxislegal.be/api/cases', {
  headers: {
    'Authorization': `Bearer ${token}`
  }
});
const data = await response.json();

Get Current User

GET /api/auth/me

Returns the currently authenticated user and firm information.

Response

{
  "user": {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "email": "john@example.com",
    "firstName": "John",
    "lastName": "Doe",
    "role": "admin",
    "firmId": "660e8400-e29b-41d4-a716-446655440001"
  },
  "firm": {
    "id": "660e8400-e29b-41d4-a716-446655440001",
    "name": "Doe & Associates",
    "subscriptionTier": "professional",
    "subscriptionExpiry": "2027-01-15T00:00:00Z"
  }
}

Change Password

POST /api/auth/change-password

Request Body

{
  "currentPassword": "oldPassword123",
  "newPassword": "newSecurePassword456"
}

Response

{
  "message": "Password changed successfully"
}

Token Expiration

A token expires after your firm's session timeout, 30 minutes by default, for any firm that has a settings row; the row is created the first time an administrator opens the firm settings or saves a Zotero key. A firm with no settings row gets the deployment's configured lifetime (14 days on Praxis Cloud). When a token expires, you'll receive a 401 response:

{
  "error": "Token expired"
}

Simply call the login endpoint again to obtain a new token.

← Back to API Overview