Signs in.
Errors
401 when the credentials do not match, 429 when too many attempts have
failed, 404 when the instance has no accounts.
application/json- body
Body of POST /auth/login.
identifier*stringUsername or email address; either is accepted.
password*stringThe account's password.
Bounded by what any instance could ever have accepted, not by the policy in force, so that raising the minimum cannot lock out an account whose password was valid when it was chosen.
8 <= length <= 1024Signed in
application/json- response
An account, as the API describes it. Never carries a hash.
email*stringNormalised address.
email_verified_at?|When the address was last proven to reach this user, or null if never.
Set by confirming a registration, by a provider vouching for the
address, or by following the link from
POST /account/email/verification. Cleared when the address changes.
date-timehas_password*booleanWhether the account has a password.
An account created through GitHub, Discord or OIDC has none. It confirms
changes by having signed in within the last few minutes instead of by
typing one, so a client shows a password field only when this is
true; see reauthentication_required.
id*stringStable identifier.
is_admin*booleanWhether the account holds the seeded administrator role.
Kept because clients read it, but derived and not stored, and narrower
than permissions. An account in a role granting users:read
and nothing else is not an administrator, yet reaches one administrative
endpoint. New clients should read permissions.
must_change_password*booleanWhether the account must set a new password before doing anything else.
Set on the administrator generated at first run. A client seeing this should send the user to a change-password screen and nowhere else.
permissions*array<string>Everything this account is allowed to do.
resource:verb strings, and what a client should decide from. A screen
guessing from is_admin is wrong for every role between "member" and
"everything".
quota_bytes?|A storage quota set on this one account, overriding its role's.
null means the role's applies; 0 means this account has no ceiling
of its own. What is actually left is storage_remaining_bytes on
/capabilities, which accounts for what has been used.
int640 <= valueroles*array<string>The roles it is in, by name.
username*stringNormalised account name.
curl -X POST 'https://example.com/api/v1/auth/login' \ -H 'Content-Type: application/json' \ -d '{ "identifier": "string", "password": "stringst"}'{ "email": "string", "email_verified_at": "2019-08-24T14:15:22Z", "has_password": true, "id": "string", "is_admin": true, "must_change_password": true, "permissions": [ "string" ], "quota_bytes": 0, "roles": [ "string" ], "username": "string"}