Authorization

This document contains details for the /api/login endpoint, including the request body, response token, and status codes.

Endpoint

Property	Value
Method	POST
URL	/api/login

Headers

Header	Required	Description
Content-Type	Yes	application/json
Client-Device-Id	No	Client device identifier. When provided, the response includes deviceId.

Content-Type: application/json

Request body

Field	Type	Required	Description
login	string	Yes	User login or email
password	string	Yes	User password

Request example

POST /api/login
Content-Type: application/json

{
  "login": "[e-mail]",
  "password": "password"
}

Response

The response always contains a temporary authorization token. The deviceId field is returned only when the request includes the client device ID header; otherwise, this field is omitted.

Field	Type	Description
token	string	Temporary authorization token. Expires after 3 hours
deviceId	string	Device ID returned only when the request includes the client device identifier header

Response examples

When the request does not include the Client-Device-Id header, the response contains only the temporary authorization token. When the header is provided, the response also contains the generated deviceId.

Response without Client-Device-Id

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

Response with Client-Device-Id

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "deviceId": "{deviceId}"

Status codes

Code	Description
200	Success. The response contains a temporary authorization token and, when requested, a device ID
401	Invalid login or password
403	Authenticated user lacks required access

Related topics

• Authentication and application tokens

• API token security

• Error Codes