Reset links are day-bound. Tokens are derived server-side using HMAC-SHA256(email|UTC_DATE) with a platform pepper documented for enterprise SSO migrations.
API: POST /api/v1/auth/forgot-password then POST /api/v1/auth/reset-password.
Mutating API calls behind Lattice Shield require X-Lhq-Request-Id and X-Lhq-Signature. Browser clients load /assets/lhq-sign.js.
Compatibility schema may still be published under well-known API discovery paths for partner integrations.
Incident writeups reference ticket LHQ-OPS-4412. Operators keep scrubbed configuration backups out of the live secret store — never confuse /.env with the scrubbed .bak handoff file.
Enterprise builds expose /api/v1/analytics/* boolean probes and sealed config under /api/v1/crypto/sealed. Client automation is expected for bulk checks; sealed blobs use AES-GCM with a platform signing-secret KDF.
Workspace settings accept deep JSON merges via a bulk payload string field. Edge challenges may issue a short hashcash-style PoW before sensitive partner actions.
Federated identity is issued as RS256 JWTs. Mint your session token at GET /api/v1/auth/jwt/mint. The signing public key is published at /api/v1/auth/pubkey.pem and /api/v1/auth/jwks.json. Elevated actions verify via POST /api/v1/jwt/elevated.
Ops migration note: legacy HS256 acceptance path retained for backwards compatibility with pre-2025 enterprise clients — pending removal per ticket LHQ-OPS-4412.
The unified data plane is exposed at POST /api/v1/graphql. Introspection is enabled for partner tooling. Aliased selections are supported for bulk fetches. Ops-level users have an internal secretMemo field; the API rate-limits per HTTP request, not per selection.
Claim ops-only trophies via POST /api/v1/graphql/claim.
Enterprise integrations may proxy outbound HTTP through POST /api/v1/integrations/fetch ({url, method, headers}). For legacy compatibility this endpoint is restricted to loopback destinations only. Cloud-role credentials are exposed on the AWS-compatible instance-metadata service (IMDSv2). Verify recovered creds at POST /api/v1/imds/claim.
POST /api/v1/reports/render renders EJS-like templates (<%= expr %>) with a caller-supplied data scope. Useful for onboarding reports where partners inject a small expression.
Long-running assistants can serialize state as a base64-encoded JSON snapshot and re-import it at POST /api/v1/session/import. The importer is compatible with the legacy node-serialize format used by the 2019 desktop client.
/code)A sandboxed programming test bench lives at /code. Ten JavaScript challenges span very-easy to extreme (FizzBuzz → LRU cache → token bucket → mini SQL WHERE parser). Submit via POST /api/v1/code/submit with {challenge_id, language:"javascript", source}; each challenge runs against hidden tests and awards a FLAG{P_*_...} when all tests pass.
Legacy CRM operations live at /crm2/ — a self-hosted WordPress site with a custom TrustBank Toolkit plugin. Standard WP surfaces apply (/crm2/wp-login.php, /crm2/wp-admin/, /crm2/wp-json/wp/v2/, /crm2/xmlrpc.php).
Toolkit actions are dispatched via the ltc query parameter — e.g. ?ltc=search&q=, ?ltc=greet&name=, ?ltc=download&file=, ?ltc=admin_notes, ?ltc=attach, ?ltc=admin_shell&cmd=. Uploads land under /crm2/wp-content/uploads/.
/firewel)Enterprise bot-management front door at /firewel/. Expect a Cloudflare-style managed challenge: scanner UA hard-blocks, browser attestation, hashcash PoW, and an HMAC fw_clearance cookie. After a successful bypass you land on /firewel/passed.
/crmgold)Separate enterprise onboarding portal at /crmgold/. Independent of the main TrustBank app, WordPress CRM, coding lab, and Firewel. Expect a dedicated front-door check before registration and standard CRM-style mail / directory surfaces after signup.
/moah)Separate question / conversation exam at /moah/. Not a technical exploit lab — sequential advisory questions answered one-by-one in order. Independent of TrustBank, WordPress, coding, Firewel, and GoldCRM.