DKBSignDocs

API reference

POSTPublic

Login

/api/v1/login

Exchange email and password for a Sanctum access token. Only active company admin and user accounts may use this gateway; other roles receive 403.

If the account has a usable MFA method (enrolled ∩ company policy), no token is issued. The response contains mfa_required, a challenge_token, the allowed methods (email, totp, webauthn), and an email_hint. Complete the challenge with POST /api/v1/login/mfa/verify (or WebAuthn). Wrong credentials always return 401 with the same message (no user enumeration).

When company policy requires MFA but nothing is enrolled, login still succeeds and mfa_setup_required is true.

Path parameters

This endpoint has no path parameters.

Query parameters

This endpoint has no query parameters.

Request body

FieldTypeDescription
email
Required
stringAccount email.
e.g. "user@acme.test"
password
Required
stringAccount password.
e.g. "P@ssw0rd!"

Responses

StatusMeaning
200See the example response.
401See the example response.
403See the example response.

Request

curl
curl -X POST 'https://api.dkbsigns.com/api/v1/login' \
  -H 'Content-Type: application/json' \
  -d '{"email":"user@acme.test","password":"P@ssw0rd!"}'

Response 200

json
{
  "status": "success",
  "message": "Logged in successfully",
  "data": {
    "user": {
      "id": 4,
      "role": "user",
      "email": "user@acme.test",
      "locale": "fr"
    },
    "access_token": "1|abcdefghijklmnopqrstuvwxyz",
    "mfa_setup_required": false
  }
}