Login

POST /auth/login

401 for not-found, inactive, wrong-password and unknown organization alike, at the same cost.

No credential

This operation is public: it authenticates by its own mechanism — a webhook signature or a channel token — rather than by a platform credential.

Request body — LoginRequest

Field	Type		Notes
email	string	required	min length 3 max length 254
password	string	required	min length 1 max length 256
organization_slug	string | null	optional	min length 2 max length 50

Responses

Status	Description	Body
200	Successful Response	—
422	Validation Error	HTTPValidationError

Only the success paths are declared

Any operation may also answer any status in the error catalogue, and every failure body is the platform envelope — including the 422 this document types as HTTPValidationError.

Example

The body shows the fields the schema always carries. Which combination is legal is a service rule the schema cannot express, so read the description above before copying this.

curl -X POST https://your-deployment.example.com/auth/login \
  -H "Content-Type: application/json" \
  -d '{
       "email": "string",
       "password": "string"
     }'