POST
Sign in
No sign-in needed For: Everyone Conditions
  • No sign-in is needed; the route allows 5 attempts per minute.
  • The type in the URL is one of user, agent, client, client_agent, organization or organization_agent; other values do not match a route.
  • The username must be an email address or 3 to 100 characters made of letters, digits, underscore, dot and hyphen. It is lower-cased before use.
  • company_id is required for type agent account, client_id for client_agent and organization_id for organization_agent; for every other type these fields are refused.
  • Wrong credentials and a deactivated account give the same refusal.
  • People (user, client, organization) must have a verified email; otherwise a specific unverified-email error is returned.
  • Agent accounts are refused at sign-in when the owning company is not active, when the client is not active, or when the organization does not match the agent account’s organization, or when the agent account’s profile no longer exists. Once signed in, people and agent accounts of a company or client that has been deactivated are refused on their next calls.
What else happens
  • Ends the previous session of the same account in that space.
  • Issues the token returned in the response.
  • For agent accounts, resets the account’s notification refresh read state.
Part of Sign up and sign in.

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

type
string
required

Kind of account signing in: user (person in a company space), agent (company agent account), client (person in a client space), client_agent, organization (person in an organization space) or organization_agent.

Body

application/json
username
string
required

Sign-in name. For people (type user, client, organization) it is the email address; for agent accounts it is the agent account's username (3 to 100 characters: letters, digits, _, . or -). It is lower-cased before use.

password
string
required

Password of the account.

company_id
string

For an agent account (type agent): identifier of the company the agent account belongs to. Refused for the other types.

client_id
string

Identifier of the client account (27-character KSUID string) the agent account signs in to. Required when the type is client_agent, refused for every other type.

organization_id
string

For an organization agent account (type organization_agent): identifier of the organization the agent account belongs to. Refused for the other types.

Response

AuthResource

auth
object
required

The new access token and its lifetime.

user
object

The signed-in member or agent account with the profile assignments usable in the session, plus is_seller and is_cashier. Omitted when the token carries no account type.