---
title: "Login Request"
method: POST
path: "/api/v1/user/login"
tags: ["User"]
---

# Login Request

`POST /api/v1/user/login`

## Request body

- object
  - `email` string, required — The email address of the user
  - `extensible` boolean
  - `otp` string, required — The one-time password
  - `password` string, required — The password

## Response `200`

OK

- LoginResponse
  - `access_token` string
  - `derivationPath` string
  - `encryptedECDHXprv` string
  - `encryptedToken` string
  - `expires_at` number, required — Unix timestamp
  - `expires_in` number, required
  - `noECDHKeychain` boolean
  - `scope` string[], required
  - `token_id` string — The public ID of the access token — used as the bearer token for v4 auth
  - `token_type` string, required
  - `grant_type` 'password' | 'passkey' | 'refresh_token' | 'authorization_code' | 'oauth', required
  - `user` User1, required — Fields that will always be populated in accordance with the defined codec If you find other fields that will provably always be populated on a given user (even for legacy users created long ago), that field can be moved to UserRequiredFields
    - `agreements` Agreements, required
      - `patriotAct` number, required
      - `termsOfUse` number, required
      - `patriotActAcceptanceDate` string, date-time
      - `termsOfUseAcceptanceDate` string, date-time
    - `allowedCoins` string[], required
    - `bitgoEmployee` boolean, required — Whether the user is a BitGo employee
    - `currency` Currency1, required
      - `bitcoinUnit` string, required
      - `currency` string, required
    - `disableReset2FA` boolean, required — Whether the user has disabled 2FA reset
    - `organizations` object[], required
      - `permissions` string[], required
      - `role` 'serviceUser' | 'admin' | 'member' | 'customer', required
      - `id` string
      - `name` string
    - `featureFlags` string[], required
    - `forceResetPassword` boolean, required — Whether the user has forced a password reset
    - `identity` Identity, required
      - `kyc` Kyc
        - `available` boolean, required
        - `required` boolean, required
        - `data` KycData
          - `state` 'unverified' | 'pending' | 'approved' | 'rejected' | 'qrscanned' | 'inreview' | 'flagged' | 'flagged_retry_allowed', required
          - `fields` object, nullable
        - `documents` KycDocuments
          - `state` 'unverified' | 'pending' | 'approved' | 'rejected' | 'qrscanned' | 'inreview' | 'flagged' | 'flagged_retry_allowed', required
        - `failureCount` number
        - `fullyRequired` boolean
        - `hasVideoID` boolean
        - `overallState` 'unverified' | 'pending' | 'approved' | 'rejected' | 'qrscanned' | 'inreview' | 'flagged' | 'flagged_retry_allowed'
        - `passport` KycPassport
          - `required` boolean, required
          - `state` 'unverified' | 'pending' | 'approved' | 'rejected' | 'qrscanned' | 'inreview' | 'flagged' | 'flagged_retry_allowed'
        - `residency` KycResidency
          - `state` 'unverified' | 'pending' | 'approved' | 'rejected' | 'qrscanned' | 'inreview' | 'flagged' | 'flagged_retry_allowed', required
        - `ongoingScreening` KycOngoingScreening
          - `state` 'approved' | 'rejected', required
        - `isScreeningRequired` boolean
        - `documentsWaived` boolean
        - `unverifiedPaygoUser` boolean
        - `enterpriseVideoCallInfo` object[]
          - `enterpriseId` string, required
          - `videoCallId` string, required
        - `enhancedVerificationLevel` 'L0' | 'L1' | 'L2' | 'L3'
      - `verified` boolean — Whether the user is verified
    - `otpDevices` object[], required
      - `createDate` string, date-time, required
      - `id` string, required
      - `backupPhone` string
      - `label` string
      - `lastValidatedDate` string, date-time
      - `phone` string
      - `registeredKey` U2FDetails
        - `certificate` string
        - `keyHandle` string
        - `publicKey` string
      - `type` 'authy' | 'totp' | 'u2f' | 'webauthn' | 'yubikey'
      - `verified` boolean
      - `scopes` string[]
      - `extensions` object
      - `prfSalt` string
      - `isPasskey` boolean
      - `credentialId` string
    - `phone` Phone, required
      - `phone` string, nullable, required
      - `verified` boolean, required
    - `timezone` string, required — The user's timezone
    - `apps` unknown
    - `country` string — The country of the user
    - `ecdhKeychain` string, nullable — The user's ECDH keychain
    - `isActive` boolean — Whether the user is active
    - `isFrozen` boolean — Whether the user is frozen
    - `freezeReason` string — The reason the user is frozen if they are frozen
    - `freeze` object — Freeze object that will hold the start time and expiration time of a user's freeze. By default the freeze is infinite, and this field will eventually override the isFrozen boolean field
      - `time` string, date-time
      - `expires` string, date-time
    - `lastLogin` string, date-time — The last login time of the user
    - `locale` string — The user's locale
    - `pgpKey` string — The user's PGP key
    - `rateLimits` unknown
    - `referrer` Referrer
      - `campaign` string, nullable
      - `source` string, nullable
    - `signupDomain` string — The signup domain of the user
    - `state` string — The state of the user
    - `sourceVerificationRequired` boolean — Whether source verification is required for the user
    - `sourceVerificationRequiredForReadOnlyAccess` boolean — Whether source verification is required for read-only access
    - `recoveryCodeSet` object — The recovery code set for the user
      - `id` string, required — The ID of the recovery code set
      - `allCodesUsed` boolean, required — Whether all recovery codes have been used
    - `createTime` string
    - `passwordUpdatedAt` string, date-time
    - `id` string, required — The unique identifier for the user
    - `username` string, email, required — The username of the user
    - `name` Name1, required
      - `first` string, required
      - `full` string, required
      - `last` string, required
    - `enterprises` object[], required
      - `permissions` string[], required
      - `id` string
      - `beneficialOwner` boolean
      - `primaryContact` string
      - `kycState` 'unverified' | 'approved' | 'rejected' | 'pending' | 'qrscanned' | 'inreview' | 'flagged' | 'flagged_retry_allowed'
      - `bitgoOrg` string
      - `name` string
      - `videoIdState` string
      - `videoIdLink` string
    - `email` Email1, required
      - `email` string, email, required
      - `verified` boolean, required
  - `warning` string
  - `sourceVerificationType` string — How the request source was verified during login.
  - `twoFactorMethod` string — The two-factor authentication method used during login.
  - `ssoProvider` string — The SSO provider used for login, when applicable.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized

---

[API](https://skmtc.net/bitgo/apis/bitgo-api.md) · [All operations](https://skmtc.net/bitgo/apis/bitgo-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/bitgo/bitgo-api/revisions/e445c15e5bee/schema)