Settings

Workspace settings (you / team) and project settings (DSN, retention, webhooks). Dashboard APIs need a session; Postgres RLS scopes rows with app.current_org_id.

How do I sign in?

Email and password at /login, or Google when GOOGLE_CLIENT_ID is set. Dashboard /api/v1/* needs the resulting cookie.

How do I open a session?

Password login returns 204 and Set-Cookie (Epure.sid on local HTTP). DSN headers on these routes return 401.

curl -sS -c cookies.txt -D - -o /dev/null -X POST \
"http://localhost:8080/api/v1/auth/login" \
-H "Content-Type: application/json" \
-d '{"email":"you@example.com","password":"your-password"}'

HTTP/1.1 204 No Content
Set-Cookie: Epure.sid=...; HttpOnly; Path=/; SameSite=Lax

Full auth table: Authentication.

What is on workspace settings?

Sign-in at /login: email + password (argon2id), or Google when GOOGLE_CLIENT_ID is set.

Session cookies: Epure.sid on HTTP (EPURE_SESSION_SECURE=0), __Host-epure.sid behind HTTPS (EPURE_SESSION_SECURE=1).

Roles (RBAC lite)

Invite by email from /team. Invitees register or sign in with Google; the assigned role applies on join.

What is on project settings?

Base path: /p/:projectId/settings

DSN keys

Create, rotate, revoke. Revoked keys → ingest 403 dsn_revoked. UI walkthrough: Projects.

curl -sS -b cookies.txt -X POST \
"http://localhost:8080/api/v1/projects/${PROJECT_ID}/dsn-keys" \
-H "Content-Type: application/json" \
-d '{"label":"local-dev"}'

HTTP/1.1 201 Created

{ "id": "<key-uuid>", "project_id": "<project-uuid>", "public_key": "a1b2…", "label": "local-dev" }

Use public_key in the DSN copied from Settings → SDK connection. Official Sentry SDKs need that public key only.

Agent tokens

Personal access tokens for MCP (any stdio host) and epure-cli. Route: /settings/agent (Admin / Owner). When creating a token, enable optional checkboxes for write:triage and write:admin (full settings API).

Tokens use prefix epure_pat_ and are shown once on create. Setup: MCP and epure-cli. HTTP: Agent API.

curl -sS -b cookies.txt -X POST \
"http://localhost:8080/api/v1/agent-tokens" \
-H "Content-Type: application/json" \
-d '{"label":"cursor","scopes":["read:agent","write:triage"]}'

HTTP/1.1 201 Created

{ "token": { "token": "epure_pat_…", "token_prefix": "…", "scopes": ["read:agent","write:triage"] } }

Revoke: POST /api/v1/agent-tokens/{id}/revoke.

Webhooks

Destinations: Slack (format: "slack"), Discord (discord), or custom HTTPS (generic).

URLs must be public HTTPS. Private/loopback targets require EPURE_WEBHOOK_ALLOW_PRIVATE=1 (dev/tests only).

curl -sS -b cookies.txt -X POST \
"http://localhost:8080/api/v1/webhooks" \
-H "Content-Type: application/json" \
-d '{"project_id":"550e8400-e29b-41d4-a716-446655440000","url":"https://hooks.example.com/epure","format":"generic","events":["issue_created","regression"]}'

HTTP/1.1 201 Created

{ "id": "<webhook-uuid>", "url": "https://hooks.example.com/epure", "format": "generic", "events": ["issue_created","regression"], "signing_secret": "<shown once>" }

Test fire: POST /api/v1/webhooks/{id}/test with the same cookie → { "sent": true }. API reference: Webhooks.

How does RLS apply for operators?

• Dashboard never trusts a client-supplied org id; membership on the session sets app.current_org_id
• Ingest does not use the app RLS role; it authenticates by DSN and writes for that project
• Three URLs: DATABASE_URL (migrations), EPURE_INGEST_DATABASE_URL, EPURE_APP_DATABASE_URL; see Configuration

Checklist

• At least one Owner exists
• Production uses HTTPS + EPURE_SESSION_SECURE=1
• Public registration closed after the first account (EPURE_REGISTRATION=false)
• DSN keys created; secrets stored outside git
• CORS origins restricted (EPURE_CORS_ORIGINS) for browser SDKs
• Webhooks pointed at public endpoints
• Retention and ingest caps set per project

Next

• Projects: DSN keys and retention
• Authentication: login 204 + cookie
• Configuration: OAuth and session cookies
• Troubleshooting: login loops and CORS