POST/api/auth/login

Ingenisa umsebenzisi njalo ikhiphe i-Session-JWT kanye le-Refresh-Token. Le yiyo kuphela indlela yokuthola i-token yokungena evumelekileyo ye-dashboard — kakulahlelo lwe-Developer-API-Key olwehlukileyo.

Ukuqinisekisa ubuwena lokuvikeleka

Kakudingeki ukuqinisekisa ubuwena

Ukwehliswa kwejubane okukhulayo kokuhlasela kwe-Brute-Force nge-imeyili ngayinye/ibizo lomsebenzisi (authGuard) -- imizamo engaphumelelanga engu-10 emizuzwini engu-5 iletha ukuphuza okukhulayo, kusukela ku-30 kuvinjwa.

I-idempotent: Hatshi

Amapharamitha

identifier(body, string, kuyadingeka)— Ikheli le-imeyili kumbe ibizo lomsebenzisi
password(body, string, kuyadingeka)— Iphasiwedi

Isibonelo sesicelo (request)

{"identifier":"user@example.com","password":"IphasiwediYenu"}

Isibonelo sempendulo (response)

{"ok":true,"token":"<JWT, isebenza 12h>","refreshToken":"<Refresh-Token, isebenza insuku ezingu-7, isetshenziswa kanye kuphela>","user":{"id":"...","tenant_id":"...","email":"user@example.com","role":"EMPLOYEE","roles":[],"permissions":[],"isMasterAdmin":false}}

Amakhodi amaphutha

401 INVALID_CREDENTIALS — I-imeyili/ibizo lomsebenzisi kumbe iphasiwedi akulunganga.
429 RATE_LIMIT_EXCEEDED — Izilingo ezehlulekileyo ezinengi kakhulu zalo i-identifier kumbe le-IP.

Ubufakazi bokuhlola okuphilayo

Impumelelo (200, i-JWT+refresh token yangempela) lecala elingaphumelelanga (401 ngephasiwedi engalunganga) kuqinisekiswe bukhoma ku-test stack ehlukanisiweyo.

← Ukuqinisekisa