Routes
The library does not provide a menu model or navigation contract. It only exposes named routes that the host application can use in its own menu, sidebar, or access rules.
| Route name | Method | Path | Purpose |
|---|---|---|---|
voyti/session-login | GET, POST | login | User login |
voyti/session-logout | POST | logout | User logout |
voyti/session-confirm | GET, POST | confirm | Two-factor confirmation step |
voyti/session-auth | GET | auth/{authclient} | Social auth redirect/callback, handled by yii-auth-client's AuthAction |
voyti/registration-register | GET, POST | register | New user registration |
voyti/registration-confirm | GET, POST | confirm/{id}/{code} | Email confirmation link |
voyti/registration-resend | GET, POST | resend | Resend confirmation email |
voyti/registration-connect | GET | connect/{code} | Social registration link |
voyti/password-reset-request | GET, POST | forgot | Password recovery request |
voyti/password-reset-confirm | GET, POST | recover/{id}/{code} | Password reset |
voyti/profile | GET | profile/{id} | Public user profile |
voyti/user | GET | settings/ | User dashboard |
voyti/user-profile | GET, POST | settings/profile | Profile settings |
voyti/user-account | GET, POST | settings/account | Account settings |
voyti/user-account-confirm | GET | settings/account/confirm/{code} | Confirm account changes |
voyti/user-social-network | GET | settings/networks/ | Linked social networks |
voyti/user-social-network-delete | POST | settings/networks/disconnect/{id} | Disconnect social account |
voyti/user-account-sessions | GET | settings/sessions/ | Self-service session/device list, current device highlighted |
voyti/user-account-sessions-terminate | POST | settings/sessions/terminate/{sessionId} | Terminate one of the current user's own sessions |
voyti/user-privacy | GET | settings/privacy/ | Privacy settings. Only registered when enableGdprCompliance or allowAccountDelete is true |
voyti/user-privacy-gdpr-consent | GET, POST | settings/privacy/gdpr-consent | GDPR consent. Only registered when enableGdprCompliance is true |
voyti/user-privacy-export | GET | settings/privacy/export | Export user data. Only registered when enableGdprCompliance is true |
voyti/user-privacy-anonymize | GET, POST | settings/privacy/anonymize | Anonymize account (blanks email/username, blocks login; row is kept). Only registered when enableGdprCompliance is true |
voyti/user-privacy-delete | GET, POST | settings/privacy/delete | Account deletion (hard delete). Only registered when allowAccountDelete is true |
voyti/user-two-factor | GET, POST | settings/two-factor/ | Two-factor status/entry point. Only registered when enableTwoFactorAuthentication is true |
voyti/user-two-factor-enable | POST | settings/two-factor/enable | Enable 2FA - shared by both the Google Authenticator and email code-entry forms. Only registered when enableTwoFactorAuthentication is true |
voyti/user-two-factor-disable | POST | settings/two-factor/disable/ | Disable 2FA. Only registered when enableTwoFactorAuthentication is true |
voyti/user-two-factor-disable-send-code | POST | settings/two-factor/disable/send-code | Send the disable-2FA one-time code. Only registered when enableTwoFactorAuthentication is true |
voyti/user-two-factor-email | GET | settings/two-factor/email/ | Email 2FA setup page (method-selector buttons + confirm/send screen). Only registered when enableTwoFactorAuthentication is true |
voyti/user-two-factor-email-send-code | POST | settings/two-factor/email/send-code | Send the email 2FA one-time code after explicit confirmation. Only registered when enableTwoFactorAuthentication is true |
voyti/user-two-factor-google | GET | settings/two-factor/google/ | Google Authenticator setup page (method-selector buttons + QR/secret). Only registered when enableTwoFactorAuthentication is true and the optional chillerlan/2fa-qrcode-bundle package is installed |
voyti/user-two-factor-google-renew | POST | settings/two-factor/google/renew | Regenerate the Google Authenticator secret/QR code via AJAX. Only registered when enableTwoFactorAuthentication is true and the optional chillerlan/2fa-qrcode-bundle package is installed |
voyti/user-two-factor-regenerate-backup-codes | POST | settings/two-factor/backup-codes/regenerate | Invalidate existing backup codes and generate a fresh set (requires re-verifying the current 2FA method). Only registered when enableTwoFactorAuthentication is true |
voyti/admin | GET | admin/ | Admin dashboard |
voyti/admin-users | GET | admin/users/ | Users |
voyti/admin-users-create | GET, POST | admin/users/create | Create user |
voyti/admin-users-update | GET, POST | admin/users/update/{id} | Update user |
voyti/admin-users-update-profile | GET, POST | admin/users/update-profile/{id} | Update user profile |
voyti/admin-users-show | GET | admin/users/info/{id} | User details |
voyti/admin-users-confirm | POST | admin/users/confirm/{id} | Confirm user |
voyti/admin-users-delete | POST | admin/users/delete/{id} | Delete user |
voyti/admin-users-block | POST | admin/users/block/{id} | Block user |
voyti/admin-users-switch-identity | POST | admin/users/switch-identity/{id} | Switch identity |
voyti/admin-users-switch-identity-restore | POST | admin/users/switch-identity/restore | Restore identity after impersonating |
voyti/admin-users-password-reset | POST | admin/users/password-reset/{id} | Send password reset |
voyti/admin-users-force-password-change | POST | admin/users/force-password-change/{id} | Force password change |
voyti/admin-users-assignments | GET, POST | admin/users/assignments/{id} | Manage RBAC assignments |
voyti/admin-users-sessions | GET | admin/users/sessions/{id} | Session management |
voyti/admin-users-terminate-sessions | POST | admin/users/terminate-sessions/{id} | Terminate sessions |
voyti/admin-rbac-permissions | GET | admin/rbac/permissions/ | List permissions |
voyti/admin-rbac-permissions-create | GET, POST | admin/rbac/permissions/create | Create permission |
voyti/admin-rbac-permissions-update | GET, POST | admin/rbac/permissions/update/{name} | Update permission |
voyti/admin-rbac-permissions-delete | POST | admin/rbac/permissions/delete/{name} | Delete permission |
voyti/admin-rbac-roles | GET | admin/rbac/roles/ | List roles |
voyti/admin-rbac-roles-create | GET, POST | admin/rbac/roles/create | Create role |
voyti/admin-rbac-roles-update | GET, POST | admin/rbac/roles/update/{name} | Update role |
voyti/admin-rbac-roles-delete | POST | admin/rbac/roles/delete/{name} | Delete role |
voyti/admin-rbac-rules | GET | admin/rbac/rules/ | List rules |
voyti/admin-rbac-rules-create | GET, POST | admin/rbac/rules/create | Create rule |
voyti/admin-rbac-rules-update | GET, POST | admin/rbac/rules/update/{name} | Update rule |
voyti/admin-rbac-rules-delete | POST | admin/rbac/rules/delete/{name} | Delete rule |
voyti/admin-audit-log | GET | admin/audit-log/ | Audit log of admin actions (RBAC and user management changes). Populated when enableAuditLog is true |
The REST API routes below live in their own voyti-routes-api
config group (see Quick
Start), separate from voyti-routes above - pull
that group into your router too if you want the API exposed, and mount
it at whatever prefix you like. See REST
API for the remaining config options.
| Route name | Method | Path | Purpose |
|---|---|---|---|
voyti/api-openapi | GET | openapi.json | OpenAPI 3.1 spec (JSON). Public, so tooling (Swagger UI, codegen) can fetch it without a Bearer token. |
voyti/api-v1-users-index | GET | v1/users | List users |
voyti/api-v1-users-view | GET | v1/users/{id} | View a user |
voyti/api-v1-users-create | POST | v1/users | Create a user |
voyti/api-v1-users-update | PATCH | v1/users/{id} | Update a user |
voyti/api-v1-users-delete | DELETE | v1/users/{id} | Delete a user |