Skip to content
Purser

Login

POST
/auth/login
curl --request POST \
  --url https://example.com/auth/login \
  --header 'Content-Type: application/json' \
  --data '{ "email": "hello@example.com", "password": "example" }'

Password sign-in; sets the session cookie.

Throttled per email and per client address (DESIGN decision 59): after repeated failures an attempt gets 429 with a Retry-After header (whole seconds) and the password is not checked. Failed and throttled attempts are audited as auth.login_failed / auth.login_throttled.

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
LoginRequest
object
email
required
Email
string format: email
password
required
Password
string

Example generated

{
  "email": "hello@example.com",
  "password": "example"
}

Responses

Section titled “Responses”

200

Section titled “200”

Successful Response

Media typeapplication/json
UserOut
object
created_at
required
Created At
string format: date-time
display_name
required
Any of:
string
email
required
Email
string
has_oidc
required
Has Oidc
boolean
has_password
required
Has Password
boolean
id
required
Id
string format: uuid
oidc_issuer
Any of:
string
role
required
Role
string

Example generated

{
  "created_at": "2026-04-15T12:00:00Z",
  "display_name": "example",
  "email": "example",
  "has_oidc": true,
  "has_password": true,
  "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "oidc_issuer": "example",
  "role": "example"
}

422

Section titled “422”

Validation Error

Media typeapplication/json
HTTPValidationError
object
detail
Detail
Array<object>
ValidationError
object
ctx
Context
object
input
Input
loc
required
Location
Array
msg
required
Message
string
type
required
Error Type
string

Example generated

{
  "detail": [
    {
      "ctx": {},
      "input": "example",
      "loc": [
        "example"
      ],
      "msg": "example",
      "type": "example"
    }
  ]
}

429

Section titled “429”

Too many failed sign-ins for this email or client address. Refused without checking the password; retry after Retry-After seconds.

Headers

Section titled “Headers”
Retry-After
integer

Seconds until a sign-in attempt is admitted again.