Sign in

v1

latestOpenAPI 3.1.02026-07-24416405768.8 KB
a) Authentication

Authenticate and obtain a JWT

Authenticates an identity and password (plus optional PKI challenge response) and returns a JWT. Store the expiry and renew before it lapses — requests with expired tokens return HTTP 401.

post/eclipse-conductor/rest/v1/authentication/login

Request body

base64EncodedChallengeHashstring

Optional: Needed when identity has a public key or responding to a WebAuthN challenge

base64EncodedChallengeResponsestring

Optional: Needed when identity has a public key or responding to a WebAuthN challenge

deviceFingerprintstring
identitystring required

Identity/username for authentication

otpstring

Optional: Needed when wanted to impersonate users with otp by a currently authenticated user - the currently authenticated user must contain a position for allowing impersonation. Also required if device fingerprinting is enabled on the tenant and the fingerprint is not enrolled

passwordstring required

Can be pre-hashed with BCRYPT or passed as clear text in which case Eclipse will hash it

scopestring[]

Optional: Request a deliberately down-scoped JWT for the currently-authenticated identity (self-scoping). Requires an existing Authorization header. The only permitted scope is 'UpdateByTasks', which forces all subsequent mutating requests (POST/PUT/DELETE/PATCH) through the task-submission workflow.

totpstring

Optional: Needed when identity has MFA enabled. This is the time based OTP for the identity

Response

OK

csrfHeaderNamestring
csrfTokenstring
expiresstring date-time

The date and time the JWT expires and should be refreshed before

expiresEpochSecsinteger
headerNamestring

The HTTP header name to use in order to pass the JWT as the bearer token. E.g. Authorization

headerValuestring

The HTTP header value to use in order to pass the JWT as the bearer token. E.g. Bearer AAAA...

refreshTokenstring
rolesstring[]

The roles this login is associated with

sessionIdstring

A unique identifier for this login session. Typiclaly not needed by the caller

tenantIdinteger

The tenant ID associated with these credentials. Optional as some identities are global and not associated to any specific tenant

Example response

{
  "expires": "2022-03-10T12:15:50-04:00"
}