Link — Identity Sidecar  running

This is the identity API for the Link messenger. It is a JSON service — not the app and not an admin panel.

Management: bearer auth required
Verification: safe mode (simulation cannot grant trust)
Invite acceptance: disabled until account and membership binding exists
Phone bootstrap: disabled (provider credentials not configured)
Storage: durable SQLite store

Endpoints

• POST /v1/orgs, POST /v1/orgs/<id>/verify-email|verify-domain|verify-business
• POST /v1/profiles, GET /v1/profiles/<matrixUserId>
• POST /v1/auth/phone/otp/request and .../verify — invite-gated SMS proof; never a recovery or application session
• POST /v1/invites, administrative GET /v1/invites, public GET /v1/invites/<code>, and management revoke; .../accept is fail-closed outside the explicit loopback demo
• /health — liveness

Set SIDECAR_DEMO_VERIFICATION=true only for the simulated local tier-ladder demo.