Update Endpoint Auth
Configure how visitors authenticate to an endpoint at the edge — before traffic ever reaches the agent. The platform offers four modes:
- none — public, no auth (the default).
- basic — HTTP Basic Auth with one or more user/password pairs stored on the endpoint.
- token — header-based bearer tokens; configure tokens via /endpoints/{id}/api-keys.
- oauth / oidc — visitors sign in with Google/GitHub/your IdP. Configure providers via /endpoints/{id}/oauth/providers first, then enable here.
For JWT-validation (apps presenting their own JWTs from your IdP) use the dedicated PUT /v1/endpoints/{id}/settings/jwt endpoint instead — that's a separate auth mechanism layered on top of the modes above.
The handler uses strict JSON decoding — unknown fields return 400. Updates merge with existing config: fields you don't include are preserved, fields you set to null are cleared.
Path parameters
id string (uuid) Req
Endpoint UUID.
Request body
mode string Req
none | basic | token | oauth | oidc.enforce_https boolean
Redirect plaintext HTTP to HTTPS. Recommended
true on any auth-enabled endpoint.session_ttl_seconds int
How long a successful login stays valid. Must be positive. Existing TTL is preserved if omitted.
enabled_auth_methods string[]
For OAuth/OIDC modes: which provider IDs are exposed on the login page. Existing list is preserved if omitted.
basic_users array
Required when
mode: "basic". List of {username, password} pairs. Passwords are hashed before storage.tokens array
Required when
mode: "token". List of valid bearer-token entries; each entry is {name, token, expires_at?}.config object
Mode-specific settings. For
basic: realm, login-page customisation. For oauth/oidc: redirect URLs, scope overrides. Schema validated per mode.Response (200 OK)
Returns the updated settings — same shape as GET /v1/endpoints/{id}/settings.
Errors
400 Bad Request
Invalid JSON, unknown fields (strict decoding), invalid
mode, mismatch between mode and supplied config (e.g. basic_users with mode: "token"), or session_ttl_seconds ≤ 0.401 Unauthorized
Missing auth.
404 Not Found
Endpoint doesn't exist or belongs to another user.
500
Database error loading or persisting the auth bundle.
Request — Basic Auth
curl -X PUT "https://api.ngris.com/v1/endpoints/<uuid>/settings" \
-H "X-API-KEY: <your_api_key>" \
-H "Content-Type: application/json" \
-d '{
"mode": "basic",
"enforce_https": true,
"session_ttl_seconds": 3600,
"basic_users": [
{"username": "admin", "password": "MyS3cur3P@ss!"}
]
}'
Python
from ngris import Ngris
client = Ngris(api_key="<your_api_key>")
client.endpoints.update_settings("<endpoint_uuid>", {
"mode": "basic",
"enforce_https": True,
"session_ttl_seconds": 3600,
"basic_users": [
{"username": "admin", "password": "MyS3cur3P@ss!"},
],
})
Request — OAuth (Google)
curl -X PUT "https://api.ngris.com/v1/endpoints/<uuid>/settings" \
-H "X-API-KEY: <your_api_key>" \
-H "Content-Type: application/json" \
-d '{
"mode": "oauth",
"enforce_https": true,
"session_ttl_seconds": 86400,
"enabled_auth_methods": ["google"]
}'
Response — 200 OK
{
"mode": "basic",
"enforce_https": true,
"session_ttl_seconds": 3600,
"enabled_auth_methods": []
}