From 82faa08412b8402726348be7663255d57cedf835 Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Sat, 18 Jul 2026 17:40:05 +0200
Subject: [PATCH] Task/remove deprecated auth endpoint (#7373)

* Remove deprecated auth endpoint

* Update changelog
---
 CHANGELOG.md                             |  1 +
 README.md                                |  2 --
 apps/api/src/app/auth/auth.controller.ts | 21 ---------------------
 3 files changed, 1 insertion(+), 23 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4e699e6cb..217aba06a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- Removed the deprecated `auth` endpoint of the login with _Security Token_ (`GET`)
 - Simplified the `getHistorical()` function response in the data provider interface
 
 ## 3.29.0 - 2026-07-18
diff --git a/README.md b/README.md
index 473d5c367..69192124f 100644
--- a/README.md
+++ b/README.md
@@ -190,8 +190,6 @@ Set the header for each request as follows:
 
 You can get the _Bearer Token_ via `POST http://localhost:3333/api/v1/auth/anonymous` (Body: `{ "accessToken": "<INSERT_SECURITY_TOKEN_OF_ACCOUNT>" }`)
 
-Deprecated: `GET http://localhost:3333/api/v1/auth/anonymous/<INSERT_SECURITY_TOKEN_OF_ACCOUNT>` or `curl -s http://localhost:3333/api/v1/auth/anonymous/<INSERT_SECURITY_TOKEN_OF_ACCOUNT>`.
-
 ### Health Check (experimental)
 
 #### Request
diff --git a/apps/api/src/app/auth/auth.controller.ts b/apps/api/src/app/auth/auth.controller.ts
index ac50f4b8a..e3886e39c 100644
--- a/apps/api/src/app/auth/auth.controller.ts
+++ b/apps/api/src/app/auth/auth.controller.ts
@@ -14,7 +14,6 @@ import {
   Controller,
   Get,
   HttpException,
-  Param,
   Post,
   Req,
   Res,
@@ -36,26 +35,6 @@ export class AuthController {
     private readonly webAuthService: WebAuthService
   ) {}
 
-  /**
-   * @deprecated
-   */
-  @Get('anonymous/:accessToken')
-  @UseGuards(CustomThrottlerGuard)
-  public async accessTokenLoginGet(
-    @Param('accessToken') accessToken: string
-  ): Promise<OAuthResponse> {
-    try {
-      const authToken =
-        await this.authService.validateAnonymousLogin(accessToken);
-      return { authToken };
-    } catch {
-      throw new HttpException(
-        getReasonPhrase(StatusCodes.FORBIDDEN),
-        StatusCodes.FORBIDDEN
-      );
-    }
-  }
-
   @Post('anonymous')
   @UseGuards(CustomThrottlerGuard)
   public async accessTokenLogin(