Orchestra Internal API Mapping

Login / Register

Complete 3-layer API flow: API Gateway → Orchestration → Core Microservices for authentication operations

View Postman Documentation

3-Layer Architecture

API Gateway Public (Internet)
Customer Account Internal Orchestration
Customer User Service / User Service Core Microservices

SERVICE LAYERS

API Gateway Layer 1 - Public
Customer Account Layer 2 - Orchestration
Microservices Layer 3 - Core

Register New User

Creates a new user account in the system

POST
API Gateway Layer 1 - Public
POST /register
Customer Account Layer 2 - Orchestration
POST /register
Customer User Service Layer 3 - Core Microservices
POST /api/users/register

Get User Account

Retrieves the current user's account details

GET
API Gateway Layer 1 - Public
GET /account
Customer Account Layer 2 - Orchestration
GET /account
Customer User Service Layer 3 - Core Microservices
GET /api/users/account

Update User Account

Updates the current user's account information

PUT
API Gateway Layer 1 - Public
PUT /account
Customer Account Layer 2 - Orchestration
PUT /account
Customer User Service Layer 3 - Core Microservices
PUT /api/users/account

Change Password

Updates the user's password (requires current password)

PUT
API Gateway Layer 1 - Public
PUT /password
Customer Account Layer 2 - Orchestration
PUT /password
Customer User Service Layer 3 - Core Microservices
PUT /api/users/password

User Login

Authenticates user and creates a session (multi-step flow)

POST
API Gateway Layer 1 - Public
POST /login
Customer Account Layer 2 - Orchestration
POST /login
Layer 3 - Sequential Microservice Calls
1 User Service
POST /passcode/validate

Validates OTP if using OTP login

2 Customer User Service
POST /api/users/login

Authenticates user credentials

3 Customer User Service
POST /api/sessions

Creates a new session for the device

Logout

Terminates user session and cleans up (multi-step flow)

DELETE
API Gateway Layer 1 - Public
DELETE /logout
Customer Account Layer 2 - Orchestration
DELETE /logout
Layer 3 - Sequential Microservice Calls
1 Customer User Service
GET /api/users/sessions

Gets current user sessions

2 Customer User Service
DELETE /api/users/logout

Logs out the user

3 Customer User Service
DELETE /api/users/sessions/{{session_id}}

Deletes the specific session

Reset Password

Resets password using OTP verification (multi-step flow)

POST
API Gateway Layer 1 - Public
POST /reset-password
Customer Account Layer 2 - Orchestration
POST /reset-password
Layer 3 - Sequential Microservice Calls
1 User Service
POST /passcode/validate

Validates the OTP sent to user

2 Customer User Service
POST /api/users/password/reset

Resets the password to new value

Send OTP

Sends one-time password to user's phone/email

POST
API Gateway Layer 1 - Public
POST /send-otp
Customer Account Layer 2 - Orchestration
POST /send-otp
User Service Layer 3 - Core Microservices
POST /passcode

Deactivate Account

Permanently deactivates the user account

POST
API Gateway Layer 1 - Public
POST /deactivate
Customer Account Layer 2 - Orchestration
POST /deactivate
Customer User Service Layer 3 - Core Microservices
DELETE /api/users/account

3-Layer Login Flow Diagram

┌─────────────────┐     ┌──────────────────┐     ┌──────────────────────┐     ┌─────────────────────────┐
│                 │     │                  │     │                      │     │                         │
│   Mobile App    │────▶│   API Gateway    │────▶│   Customer Account   │────▶│   Core Microservices    │
│   / Web Client  │     │   (Layer 1)      │     │   (Layer 2)          │     │   (Layer 3)             │
│                 │     │   PUBLIC         │     │   INTERNAL           │     │   INTERNAL              │
└─────────────────┘     └──────────────────┘     └──────────────────────┘     └─────────────────────────┘
        │                        │                         │                            │
        │  POST /login           │                         │                            │
        │  Headers:              │                         │                            │
        │  - X-Tenant-Id         │                         │                            │
        │  - X-Store-Id          │                         │                            │
        │  - X-Device-Id         │                         │                            │
        │  ──────────────────────▶                         │                            │
        │                        │  POST /login            │                            │
        │                        │  (Route + Auth)         │                            │
        │                        │  ────────────────────────▶                           │
        │                        │                         │  1. POST /passcode/validate│
        │                        │                         │  ─────────────────────────────▶  [User Service]
        │                        │                         │                            │
        │                        │                         │  2. POST /api/users/login  │
        │                        │                         │  ─────────────────────────────▶  [Customer User Service]
        │                        │                         │                            │
        │                        │                         │  3. POST /api/sessions     │
        │                        │                         │  ─────────────────────────────▶  [Customer User Service]
        │                        │                         │                            │
        │                        │  ◀──── Response ────────│                            │
        │  ◀──── Response ───────│                         │                            │
        │  { access_token, user }│                         │                            │

Architecture Summary

API Gateway

Public entry point. Handles routing, rate limiting, CORS, and initial authentication.

Layer 1

Customer Account

Orchestration layer. Coordinates multiple microservice calls for authentication flows.

Layer 2

Customer User Service

Core microservice for user data, sessions, and account management.

10 APIs

User Service

Core microservice for OTP generation and validation.

2 APIs

Orchestra Internal API Mapping - Login/Register Module

Last Updated: December 2025