Login with email and password (MFA aware)
POST/auth/login
Exchanges credentials for an access token + refresh token. Rate-limited to 10 attempts per minute per IP. If the user has MFA enabled, mfaToken (6-digit TOTP) is required; omitting it returns 401 with an mfaRequired code. Emits auth.login.success or auth.login.failed security events.
Request
Responses
- 200
- 201
- 400
- 401
- 409
- 429
- 500
Bearer access token, refresh token, and the authenticated user summary.
Resource created. Body follows the shared { data, meta } envelope; data is the newly-created resource.
Payload invalid.
Credentials wrong, account locked, or MFA token missing/invalid.
The request conflicts with the current state of the target resource — a duplicate unique field on registration, an idempotency-key replay with a different payload, or a webhook eventId that has already been processed. error.code may be CONFLICT or IDEMPOTENCY_CONFLICT depending on the cause.
Rate limit exceeded. Global default is 120 requests/minute per IP; auth-flow, OTP, self-registration, WebAuthn, IRA lookup, and public-lead endpoints carry tighter per-endpoint limits. Retry after the delay indicated by the Retry-After header.
Response Headers
Seconds to wait before retrying.
Unhandled server error. The response carries a meta.requestId correlator you can hand to platform operations to trace the failure through structured logs and the hash-chained audit trail. Retry with the same Idempotency-Key header if the endpoint accepts idempotency.