Skip to content

OxideAuth API

Identity & Access Management Platform

OxideAuth is a multi-tenant IAM (Identity & Access Management) REST API built in Rust. It provides authentication, role-based access control (RBAC), workspace management, and credential lifecycle management.

Key Features

  • Multi-Tenancy — Workspaces isolate users, projects, and permissions
  • RBAC — Fine-grained role and permission system with wildcard support (account:*, *:read)
  • JWT Authentication — HS256-signed tokens with revocation and refresh support
  • OAuth2 / OIDC — Google OAuth integration for social login
  • Credential Management — Password, OAuth, SSO, and API key credential types
  • Token Revocation — Blacklist tokens by SHA-256 hash with expiry tracking
  • Email — AWS SES integration with Tera HTML templates

Architecture Overview

graph TD
    Client[API Client] -->|POST JSON + Bearer Token| Axum[Axum HTTP Server]
    Axum --> Auth[CtxMiddleware]
    Auth -->|Resolves JWT → CoreCtx| Handlers[Route Handlers]
    Handlers --> Services[Service Layer]
    Services -->|Permission Check| Perms[PermissionEngine]
    Services --> Store[Data Access Layer]
    Store --> PG[(PostgreSQL)]
    Services --> Cache[(Redis)]

API at a Glance

Resource Endpoints Description
Health 2 Server liveness & root endpoint
Auth 11 Authentication, OAuth2, token & password management
Workspaces 5 Multi-tenant containers
Accounts 5 User identity management
Projects 5 Scoped work areas within workspaces
Roles 5 Permission bundles
Permissions 5 Fine-grained access control
Memberships 5 Account-to-workspace/project links
Credentials 4 Auth credential lifecycle

50 total endpoints — all JSON POST (except 2 GET health endpoints and 1 GET OAuth callback) with a standard { success, status, data } envelope.

Data Model

erDiagram
    Workspace ||--o{ Project : contains
    Workspace ||--o{ Membership : has
    Workspace ||--o{ Role : defines
    Workspace ||--o{ Permission : defines
    Account ||--o{ Membership : belongs_to
    Account ||--o{ Credential : authenticates_with
    Membership }o--|| Project : scoped_to
    Membership }o--o{ Role : assigned
    Role }o--o{ Permission : bundles
    Account ||--o{ Token : has_revoked