Log in

OpenAPI contract

Method

POST

Path

/api/v1/auth/login

Security

None

Response status

200 400 401 429 500

Request and response schemas

JSON

{
  "requestBody": {
    "application/json": {
      "$ref": "#/components/schemas/LoginRequest"
    }
  },
  "responses": {
    "200": {
      "description": "Session created",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/AuthResponse"
        }
      }
    },
    "400": {
      "description": "Invalid request",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/RequestError"
        }
      }
    },
    "401": {
      "description": "Username or password was rejected",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/ApiError"
        }
      }
    },
    "429": {
      "description": "Rate limit exceeded",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "500": {
      "description": "Unexpected server error",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/ApiError"
        }
      }
    }
  }
}

POST /api/v1/auth/login is public. Send nonblank username and password in JSON. A successful login returns an access token, refresh token, token type, and access-token lifetime in seconds.

Use the access token as Authorization: Bearer <access token> only over HTTPS. Keep both tokens out of URLs, logs, browser-visible configuration, and error reports. Invalid credentials are returned as an authentication error.

http

POST /api/v1/auth/login
Content-Type: application/json