POST/api/auth/login

Ingenisa umsebenzisi kwaye ikhuphe i-Session-JWT kunye ne-Refresh-Token. Le kuphela kwendlela yokufumana i-token yokufikelela esebenzayo ye-dashboard — akukho nkqubo eyahlukileyo yezitshixo ze-API zabaphuhlisi.

Ukuqinisekiswa nokhuseleko

Akukho kuqinisekiswa kufunekayo

Ukucothisa okunyukayo kwe-Brute-Force nge-imeyile/igama lomsebenzisi ngalinye (authGuard) -- imizamo engaphumelelanga eli-10 kwimizuzu emi-5 ikhokelela ekulibazisekeni okunyukayo, ukusuka kwi-30 kuvalwa.

Idempotent: Hayi

Iiparamitha

identifier(body, string, kuyafuneka)— Idilesi ye-imeyile okanye igama lomsebenzisi
password(body, string, kuyafuneka)— Ipasiwedi

Umzekelo we-request

{"identifier":"user@example.com","password":"IphasiwediYakho"}

Umzekelo we-response

{"ok":true,"token":"<JWT, isebenza 12h>","refreshToken":"<Refresh token, isebenza iintsuku ezi-7, isetyenziswa kanye kuphela>","user":{"id":"...","tenant_id":"...","email":"user@example.com","role":"EMPLOYEE","roles":[],"permissions":[],"isMasterAdmin":false}}

Iikhowudi zeempazamo

401 INVALID_CREDENTIALS — I-imeyile/igama lomsebenzisi okanye iphasiwedi ayichanekanga.
429 RATE_LIMIT_EXCEEDED — Iinzame ezininzi kakhulu ezingaphumelelanga zale Identifier okanye le IP.

Ubungqina bovavanyo oluphilayo

Impumelelo (200, i-JWT+Refresh-Token yokwenene) kunye nemeko engaphumelelanga (401 xa iphasiwedi ingalunganga) ziqinisekisiwe ngqo kwi-test-stack ehlukanisiweyo.

← Ungqinisiso