Authentication and accounts
===========================

``POST /api/register`` creates an account. Usernames are 3--32 characters
using letters, numbers, ``_``, and ``-``; passwords are 8--72 characters.

``POST /api/login`` creates an HttpOnly ``rtcord_session`` cookie. Send it on
authenticated requests. ``POST /api/logout`` clears the current session.

Account endpoints expose the current standing and warnings, email attachment
and verification, and password-reset request and completion. Account standing
levels are:

* 0 — all good;
* 1 — cannot accept invites or join servers;
* 2 — cannot create group chats or send direct/group messages;
* 3 — cannot send messages;
* 4 — suspended from normal authenticated APIs, while account pages remain
  available.

See :download:`API.md <../../API.md>` for exact payloads and status details.