curl --request POST \
--url https://{subdomain}.outseta.com/api/v1/tokensimport requests
url = "https://{subdomain}.outseta.com/api/v1/tokens"
response = requests.post(url)
print(response.text)const options = {method: 'POST'};
fetch('https://{subdomain}.outseta.com/api/v1/tokens', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{subdomain}.outseta.com/api/v1/tokens",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://{subdomain}.outseta.com/api/v1/tokens"
req, _ := http.NewRequest("POST", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://{subdomain}.outseta.com/api/v1/tokens")
.asString();require 'uri'
require 'net/http'
url = URI("https://{subdomain}.outseta.com/api/v1/tokens")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
response = http.request(request)
puts response.read_body{
"access_token": "string",
"authentication_callback_url": "string",
"expires_in": 0,
"id_token": "string",
"refresh_token": "string",
"token_type": "string"
}{
"two_factor_required": false,
"two_factor_enrollment_required": false,
"challenge_token": "string",
"mechanism": "string",
"masked_destination": "string",
"expires_in": 0,
"available_mechanisms": [
"string"
],
"recovery_codes_available": false
}"string"Log a user in.
Authenticates a user and returns a JWT access token (plus a refresh token).
Post a JSON body with the user’s credentials:
{ "username": "user@example.com", "password": "their-password" }
On success the response is 200 with an access token and refresh token:
{ "access_token": "eyJ...", "refresh_token": "...", "token_type": "Bearer", "expires_in": 31536000 }
Two-factor authentication. If the user has a verified 2FA method,
the password alone is not enough. After verifying the password this
endpoint instead returns 202 Accepted with a challenge that must be
satisfied via POST /api/v1/tokens/two-factor:
{
"two_factor_required": true,
"challenge_token": "eyJ...",
"mechanism": "Totp",
"masked_destination": "",
"expires_in": 600,
"available_mechanisms": ["Totp", "Email"],
"recovery_codes_available": true
}
mechanism is the method this challenge targets. When it is Email,
a one-time code has already been emailed to the user (see
masked_destination); when it is Totp, the user reads the current
code from their authenticator app and nothing is sent.
available_mechanisms lists every method the user has enrolled so a
client can offer a switch via POST /api/v1/tokens/two-factor/switch-mechanism.
If the tenant forces 2FA but the user has not enrolled yet, the 202
body instead contains "two_factor_enrollment_required": true with a
challenge_token to drive the mid-login enrollment endpoints.
Invalid credentials return 400 with a body of invalid_grant.
curl --request POST \
--url https://{subdomain}.outseta.com/api/v1/tokensimport requests
url = "https://{subdomain}.outseta.com/api/v1/tokens"
response = requests.post(url)
print(response.text)const options = {method: 'POST'};
fetch('https://{subdomain}.outseta.com/api/v1/tokens', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{subdomain}.outseta.com/api/v1/tokens",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://{subdomain}.outseta.com/api/v1/tokens"
req, _ := http.NewRequest("POST", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://{subdomain}.outseta.com/api/v1/tokens")
.asString();require 'uri'
require 'net/http'
url = URI("https://{subdomain}.outseta.com/api/v1/tokens")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
response = http.request(request)
puts response.read_body{
"access_token": "string",
"authentication_callback_url": "string",
"expires_in": 0,
"id_token": "string",
"refresh_token": "string",
"token_type": "string"
}{
"two_factor_required": false,
"two_factor_enrollment_required": false,
"challenge_token": "string",
"mechanism": "string",
"masked_destination": "string",
"expires_in": 0,
"available_mechanisms": [
"string"
],
"recovery_codes_available": false
}"string"