Reference
Architecture
The estate as drawn, and the two integration contracts that hold it together.
Contract 01
Browser sign-in
The catalog sends the browser to Edy-Auth with the site origin and a return address. Edy-Auth authenticates, then redirects back with a site token. The catalog never sees the password.
GET /api/v1/auth/getauthtoken?site=…&RedirectTo=…
Contract 02
Token introspection
The catalog exchanges that token for an identity server-to-server, over the container network. This is the endpoint Edy-Auth publishes so sibling services can resolve roles without re-running the login flow.
GET /api/v1/introspect?token=… → {valid, user_guid, roles}