Login

POST /api/auth/login

Authenticate a user with username or email and password. Returns an access token in the response body and sets a refresh token as an HTTP-only cookie.

Auth: Public (no authentication required)

Request Body

Field	Type	Required	Description
`identifier`	string	Yes	Username or email address
`password`	string	Yes	User password (minimum 8 characters)

Example

curl -X POST https://api.reten.ai/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "identifier": "admin@example.com",
    "password": "SecurePass123!"
  }'

const response = await fetch("https://api.reten.ai/api/auth/login", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    identifier: "admin@example.com",
    password: "SecurePass123!",
  }),
});
const data = await response.json();
const accessToken = data.accessToken;

import requests

response = requests.post(
    "https://api.reten.ai/api/auth/login",
    json={
        "identifier": "admin@example.com",
        "password": "SecurePass123!",
    },
)
data = response.json()
access_token = data["accessToken"]

Response `201 Created`

{
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "user": {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "username": "jdoe",
    "email": "jdoe@example.com",
    "firstName": "Jane",
    "lastName": "Doe",
    "roles": ["viewer"],
    "permissions": [
      "project:view",
      "user:view",
      "activity:view",
      "commerce-lifecycle-snapshot:view"
    ],
    "tenantIds": ["660e8400-e29b-41d4-a716-446655440000"]
  }
}

Field	Type	Description
`accessToken`	string	Access token for the `Authorization: Bearer` header
`user.roles`	string[]	Role values of the user (see Roles & Permissions)
`user.permissions`	string[]	Permissions granted by all of the user's roles; the order is not guaranteed
`user.tenantIds`	string[]	Tenants the user belongs to — each is a valid `x-tenant-id`

The access token carries roles, permissions and tenantIds as they were when it was issued: a change of roles takes effect on the next login or refresh.

The refresh token is set as an HTTP-only cookie (refreshToken) with a 7-day expiration.

Error Responses

Status	Description
`400`	Validation error — `identifier` is empty or `password` is shorter than 8 characters
`401`	Wrong identifier or password — `Invalid credentials`
`401`	The user is deactivated — `User account is deactivated`