Email-first auth-method discovery for the login form: given an email, returns which sign-in methods the user can use (password and/or jumpcloud), their preferred method, and a JumpCloud SSO redirect URL when SSO is available. Unknown emails always return ["password"] so the endpoint cannot be used to enumerate accounts.

Auth: Both — public route (no authentication); throttled at 10/min per IP. No role scoping — purely email lookup; SSO branching is driven by the user's sso_required flag, auth_methods, and preferred_auth_method.

Rate limit: 10 requests/min per IP.

Request

• Body:

Response — { data. } envelope.

• methods (string[]) — subset/ordering of ["password", "jumpcloud"]. If sso_required, exactly ["jumpcloud"]; otherwise built from canUsePassword/canUseJumpCloud, falling back to ["password"] if empty. Unknown email falls back to ["password"].
• preferred (string) — user.preferred_auth_method or "password" fallback ("password" for unknown email)
• sso_url (string|null) — ./api/v1/auth/sso/jumpcloud/redirect when jumpcloud is in methods, else null

Errors: 422 on validation failure.