# Identity Edge API

## Active External Protocol

- REST is the active external protocol for this BFF deployment.
- Internal service calls default to gRPC-adapted contracts.

## Entrypoints

- `POST /api/identity/token`
- `POST /api/identity/session/refresh`

## Boundary Notes

- Endpoint handlers perform edge validation and permission checks.
- Token issuance and policy evaluation requests are mapped to thalos-service identity contracts.
- Session refresh requests are mapped through edge contract adapters before downstream calls.
- Business orchestration remains in thalos-service.
- Identity abstractions remain owned by Thalos repositories.