---
title: Authenticate user and issue tokens
slug: api-documentation/authenticate-user-and-issue-tokens
docTags: 
createdAt: 2026-08-27T16:53:30.249Z
---

{
  "id": "OJbhCGjylDmicrUDitFXz",
  "type": "api-oas-v2",
  "data": {
    "method": "POST",
    "url": "https://api.upstartcommerce.com/api/v1/auth/login",
    "servers": [
      {
        "url": "https://api.upstartcommerce.com/api/v1/auth/login",
        "description": "Production"
      }
    ],
    "name": "Authenticate user and issue tokens",
    "description": "<p>Validates user credentials and issues JWT access and refresh tokens.</p>\n<p>Tenant context is resolved in priority order:</p>\n<ol>\n<li><code>Authorization: Bearer &#x3C;guest-token></code> — tenant extracted from the guest token's <code>tenant</code> claim (preferred)</li>\n<li><code>x-upstart-tenant</code> header — explicit tenant selection (fallback, deprecated)</li>\n</ol>\n<p>The guest token is issued by the <code>/api/v1/auth/guest</code> endpoint and carries the tenant\n(and site) context for the current browsing session. Clients should always present the\nguest token; the <code>x-upstart-tenant</code> header is retained for backwards compatibility only.</p>\n<p>The token includes <code>siteRoles</code> containing all sites the user can access.\nSite context is determined at runtime via the <code>x-upstart-site</code> header on\nsubsequent API calls, not at login time.</p>\n<p>The response includes both an access token (short-lived, for API calls) and\na refresh token (long-lived, for obtaining new access tokens).</p>",
    "contentType": "application/json",
    "request": {
      "pathParameters": [],
      "headerParameters": [
        {
          "name": "accept",
          "type": "string",
          "kind": "optional",
          "description": "Generated from available response content types",
          "enum": [
            "application/json"
          ],
          "default": "application/json"
        },
        {
          "kind": "optional",
          "name": "Authorization",
          "type": "string",
          "example": "Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
          "description": "<p>Guest token issued by <code>/api/v1/auth/guest</code>, carrying tenant (and site) context for the session.\nThe <code>tenant</code> claim is extracted and used as the active tenant for this login.\nFalls back to <code>x-upstart-tenant</code> if absent or if the token cannot be parsed.</p>",
          "pattern": "^Bearer .+$"
        },
        {
          "kind": "optional",
          "name": "x-upstart-tenant",
          "type": "string",
          "example": "tenant-123",
          "description": "<p>Tenant identifier for multi-tenant authentication.</p>\n<p>Required when user is authorized for multiple tenants.\nOptional when user has exactly one authorized tenant (auto-selected).</p>"
        }
      ],
      "queryParameters": [],
      "bodyDataParameters": [
        {
          "kind": "required",
          "name": "body",
          "type": "object",
          "description": "User credentials for authentication",
          "customType": "LoginRequest",
          "schema": [
            {
              "name": "username",
              "kind": "required",
              "type": "string",
              "description": "User's username or email address",
              "example": "user@example.com"
            },
            {
              "name": "password",
              "kind": "required",
              "type": "string<password>",
              "description": "User's password",
              "example": "securePassword123",
              "format": "password"
            },
            {
              "name": "tokenType",
              "kind": "required",
              "type": "string<consumer | management>",
              "description": "<p>Type of authentication session:</p>\n<ul>\n<li><code>consumer</code>: High-volume consumer traffic with fixed role mapping</li>\n<li><code>management</code>: Admin/management traffic with dynamic permission queries</li>\n</ul>",
              "example": "consumer",
              "enum": [
                "consumer",
                "management"
              ]
            }
          ],
          "modelRef": "#/components/schemas/LoginRequest",
          "isExpanded": true
        }
      ],
      "formDataParameters": [],
      "oAuthParameters": [],
      "cookieParameters": []
    },
    "responses": [
      {
        "statusCode": "200",
        "description": "<p>Authentication result. Either:</p>\n<ul>\n<li>Successful authentication with tokens (mfaRequired=false or absent)</li>\n<li>MFA challenge required (mfaRequired=true)</li>\n</ul>",
        "jsonExample": "",
        "isExpanded": true,
        "subExamples": [
          {
            "label": "GENERATED",
            "code": "// Authentication result. Either:\n\nSuccessful authentication with tokens (mfaRequired=false or absent)\nMFA challenge required (mfaRequired=true)\n{\n  \"mfaRequired\": false,\n  \"accessToken\": \"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...\",\n  \"refreshToken\": \"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...\",\n  \"expiresIn\": 3600,\n  \"tokenType\": \"Bearer\",\n  \"mfaChallengeId\": \"ch_abc123xyz\",\n  \"mfaMethod\": \"totp\",\n  \"mfaExpiresIn\": 300,\n  \"mfaMaskedPhoneNumber\": \"***1234\"\n}"
          },
          {
            "label": "successfulLogin",
            "code": "// Successful login (no MFA)\n{\n  \"mfaRequired\": false,\n  \"accessToken\": \"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...\",\n  \"refreshToken\": \"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...\",\n  \"expiresIn\": 3600,\n  \"tokenType\": \"Bearer\"\n}"
          },
          {
            "label": "mfaRequired",
            "code": "// MFA verification required\n{\n  \"mfaRequired\": true,\n  \"mfaChallengeId\": \"ch_abc123xyz\",\n  \"mfaMethod\": \"totp\",\n  \"mfaExpiresIn\": 300\n}"
          }
        ],
        "schema": [
          {
            "kind": "optional",
            "type": "object",
            "description": "<p>Login response that indicates either successful authentication or MFA requirement.</p>\n<p>When mfaRequired is false or absent: accessToken, refreshToken, expiresIn, tokenType are present\nWhen mfaRequired is true: mfaChallengeId, mfaMethod, mfaExpiresIn are present</p>",
            "customType": "LoginResponse",
            "schema": [
              {
                "name": "mfaRequired",
                "kind": "required",
                "type": "boolean",
                "description": "Whether MFA verification is required before tokens are issued",
                "example": false
              },
              {
                "name": "accessToken",
                "kind": "optional",
                "type": "string",
                "description": "<p>JWT access token (present when mfaRequired is false)</p>",
                "example": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."
              },
              {
                "name": "refreshToken",
                "kind": "optional",
                "type": "string",
                "description": "<p>Refresh token (present when mfaRequired is false)</p>",
                "example": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."
              },
              {
                "name": "expiresIn",
                "kind": "optional",
                "type": "integer<int64>",
                "description": "<p>Access token validity in seconds (present when mfaRequired is false)</p>",
                "example": 3600,
                "format": "int64"
              },
              {
                "name": "tokenType",
                "kind": "optional",
                "type": "string",
                "description": "<p>Token type, always \"Bearer\" (present when mfaRequired is false)</p>",
                "example": "Bearer"
              },
              {
                "name": "mfaChallengeId",
                "kind": "optional",
                "type": "string",
                "description": "<p>MFA challenge ID for verification (present when mfaRequired is true)</p>",
                "example": "ch_abc123xyz"
              },
              {
                "name": "mfaMethod",
                "kind": "optional",
                "type": "string<totp | sms>",
                "description": "<p>MFA method for verification (present when mfaRequired is true)</p>",
                "example": "totp",
                "enum": [
                  "totp",
                  "sms"
                ]
              },
              {
                "name": "mfaExpiresIn",
                "kind": "optional",
                "type": "integer<int64>",
                "description": "<p>Seconds until MFA challenge expires (present when mfaRequired is true)</p>",
                "example": 300,
                "format": "int64"
              },
              {
                "name": "mfaMaskedPhoneNumber",
                "kind": "optional",
                "type": "string",
                "description": "<p>Masked phone number for SMS MFA (present when mfaMethod is sms)</p>",
                "example": "***1234"
              }
            ],
            "modelRef": "#/components/schemas/LoginResponse",
            "isExpanded": true
          }
        ]
      },
      {
        "statusCode": "400",
        "description": "<p>Bad request - invalid JSON, missing fields, or tenant selection required</p>",
        "jsonExample": "",
        "isExpanded": true,
        "subExamples": [
          {
            "label": "GENERATED",
            "code": "// Bad request - invalid JSON, missing fields, or tenant selection required\n{\n  \"error\": \"unauthorized\",\n  \"message\": \"Invalid username or password\",\n  \"code\": \"UNAUTHORIZED\"\n}"
          },
          {
            "label": "invalidRequest",
            "code": "// Invalid request body\n{\n  \"error\": \"invalid_request\",\n  \"message\": \"Failed to read request body\",\n  \"code\": \"BAD_REQUEST\"\n}"
          },
          {
            "label": "tenantRequired",
            "code": "// Tenant selection required\n{\n  \"error\": \"tenant_required\",\n  \"message\": \"Multiple tenants available; tenant selection required via x-upstart-tenant header\",\n  \"code\": \"TENANT_REQUIRED\"\n}"
          },
          {
            "label": "invalidTokenType",
            "code": "// Invalid token type\n{\n  \"error\": \"invalid_request\",\n  \"message\": \"Invalid token type. Must be 'consumer' or 'management'\",\n  \"code\": \"BAD_REQUEST\"\n}"
          }
        ],
        "schema": [
          {
            "kind": "optional",
            "type": "object",
            "description": "Standard error response format",
            "customType": "ErrorResponse",
            "schema": [
              {
                "name": "error",
                "kind": "required",
                "type": "string",
                "description": "<p>Error type identifier:</p>\n<ul>\n<li><code>invalid_request</code>: Malformed request or missing required fields</li>\n<li><code>unauthorized</code>: Invalid credentials or token</li>\n<li><code>account_not_verified</code>: Account exists but email/phone not verified</li>\n<li><code>session_expired</code>: Maximum session lifetime exceeded, full re-login required</li>\n<li><code>unauthorized_tenant</code>: User not authorized for requested tenant</li>\n<li><code>tenant_required</code>: Multi-tenant user must specify tenant</li>\n<li><code>unauthorized_site</code>: User not authorized for requested site</li>\n<li><code>site_required</code>: Site context required for this operation</li>\n<li><code>no_authorized_sites</code>: User has no authorized sites</li>\n<li><code>forbidden</code>: Access denied (e.g., no authorized tenants)</li>\n<li><code>rate_limited</code>: Too many requests, try again later</li>\n<li><code>account_locked</code>: Account temporarily locked due to failed attempts</li>\n<li><code>internal_error</code>: Server-side error</li>\n</ul>",
                "example": "unauthorized"
              },
              {
                "name": "message",
                "kind": "required",
                "type": "string",
                "description": "<p>Human-readable error description</p>",
                "example": "Invalid username or password"
              },
              {
                "name": "code",
                "kind": "required",
                "type": "string<BAD_REQUEST | UNAUTHORIZED | UNAUTHORIZED_TENANT | TENANT_REQUIRED | FORBIDDEN | RATE_LIMITED | ACCOUNT_LOCKED | INTERNAL_SERVER_ERROR>",
                "description": "HTTP status code name",
                "example": "UNAUTHORIZED",
                "enum": [
                  "BAD_REQUEST",
                  "UNAUTHORIZED",
                  "UNAUTHORIZED_TENANT",
                  "TENANT_REQUIRED",
                  "FORBIDDEN",
                  "RATE_LIMITED",
                  "ACCOUNT_LOCKED",
                  "INTERNAL_SERVER_ERROR"
                ]
              }
            ],
            "modelRef": "#/components/schemas/ErrorResponse",
            "isExpanded": true
          }
        ]
      },
      {
        "statusCode": "401",
        "description": "Invalid credentials",
        "jsonExample": "",
        "isExpanded": true,
        "schema": [
          {
            "kind": "optional",
            "type": "object",
            "example": "{\"error\":\"unauthorized\",\"message\":\"Invalid username or password\",\"code\":\"UNAUTHORIZED\"}",
            "description": "Standard error response format",
            "customType": "ErrorResponse",
            "schema": [
              {
                "name": "error",
                "kind": "required",
                "type": "string",
                "description": "<p>Error type identifier:</p>\n<ul>\n<li><code>invalid_request</code>: Malformed request or missing required fields</li>\n<li><code>unauthorized</code>: Invalid credentials or token</li>\n<li><code>account_not_verified</code>: Account exists but email/phone not verified</li>\n<li><code>session_expired</code>: Maximum session lifetime exceeded, full re-login required</li>\n<li><code>unauthorized_tenant</code>: User not authorized for requested tenant</li>\n<li><code>tenant_required</code>: Multi-tenant user must specify tenant</li>\n<li><code>unauthorized_site</code>: User not authorized for requested site</li>\n<li><code>site_required</code>: Site context required for this operation</li>\n<li><code>no_authorized_sites</code>: User has no authorized sites</li>\n<li><code>forbidden</code>: Access denied (e.g., no authorized tenants)</li>\n<li><code>rate_limited</code>: Too many requests, try again later</li>\n<li><code>account_locked</code>: Account temporarily locked due to failed attempts</li>\n<li><code>internal_error</code>: Server-side error</li>\n</ul>",
                "example": "unauthorized"
              },
              {
                "name": "message",
                "kind": "required",
                "type": "string",
                "description": "<p>Human-readable error description</p>",
                "example": "Invalid username or password"
              },
              {
                "name": "code",
                "kind": "required",
                "type": "string<BAD_REQUEST | UNAUTHORIZED | UNAUTHORIZED_TENANT | TENANT_REQUIRED | FORBIDDEN | RATE_LIMITED | ACCOUNT_LOCKED | INTERNAL_SERVER_ERROR>",
                "description": "HTTP status code name",
                "example": "UNAUTHORIZED",
                "enum": [
                  "BAD_REQUEST",
                  "UNAUTHORIZED",
                  "UNAUTHORIZED_TENANT",
                  "TENANT_REQUIRED",
                  "FORBIDDEN",
                  "RATE_LIMITED",
                  "ACCOUNT_LOCKED",
                  "INTERNAL_SERVER_ERROR"
                ]
              }
            ],
            "modelRef": "#/components/schemas/ErrorResponse",
            "isExpanded": true
          }
        ]
      },
      {
        "statusCode": "403",
        "description": "<p>Forbidden - unauthorized tenant or no authorized tenants</p>",
        "jsonExample": "",
        "isExpanded": true,
        "subExamples": [
          {
            "label": "GENERATED",
            "code": "// Forbidden - unauthorized tenant or no authorized tenants\n{\n  \"error\": \"unauthorized\",\n  \"message\": \"Invalid username or password\",\n  \"code\": \"UNAUTHORIZED\"\n}"
          },
          {
            "label": "unauthorizedTenant",
            "code": "// Unauthorized tenant\n{\n  \"error\": \"unauthorized_tenant\",\n  \"message\": \"User is not authorized for tenant: tenant-xyz\",\n  \"code\": \"UNAUTHORIZED_TENANT\"\n}"
          },
          {
            "label": "noAuthorizedTenants",
            "code": "// No authorized tenants\n{\n  \"error\": \"forbidden\",\n  \"message\": \"User has no authorized tenants\",\n  \"code\": \"FORBIDDEN\"\n}"
          }
        ],
        "schema": [
          {
            "kind": "optional",
            "type": "object",
            "description": "Standard error response format",
            "customType": "ErrorResponse",
            "schema": [
              {
                "name": "error",
                "kind": "required",
                "type": "string",
                "description": "<p>Error type identifier:</p>\n<ul>\n<li><code>invalid_request</code>: Malformed request or missing required fields</li>\n<li><code>unauthorized</code>: Invalid credentials or token</li>\n<li><code>account_not_verified</code>: Account exists but email/phone not verified</li>\n<li><code>session_expired</code>: Maximum session lifetime exceeded, full re-login required</li>\n<li><code>unauthorized_tenant</code>: User not authorized for requested tenant</li>\n<li><code>tenant_required</code>: Multi-tenant user must specify tenant</li>\n<li><code>unauthorized_site</code>: User not authorized for requested site</li>\n<li><code>site_required</code>: Site context required for this operation</li>\n<li><code>no_authorized_sites</code>: User has no authorized sites</li>\n<li><code>forbidden</code>: Access denied (e.g., no authorized tenants)</li>\n<li><code>rate_limited</code>: Too many requests, try again later</li>\n<li><code>account_locked</code>: Account temporarily locked due to failed attempts</li>\n<li><code>internal_error</code>: Server-side error</li>\n</ul>",
                "example": "unauthorized"
              },
              {
                "name": "message",
                "kind": "required",
                "type": "string",
                "description": "<p>Human-readable error description</p>",
                "example": "Invalid username or password"
              },
              {
                "name": "code",
                "kind": "required",
                "type": "string<BAD_REQUEST | UNAUTHORIZED | UNAUTHORIZED_TENANT | TENANT_REQUIRED | FORBIDDEN | RATE_LIMITED | ACCOUNT_LOCKED | INTERNAL_SERVER_ERROR>",
                "description": "HTTP status code name",
                "example": "UNAUTHORIZED",
                "enum": [
                  "BAD_REQUEST",
                  "UNAUTHORIZED",
                  "UNAUTHORIZED_TENANT",
                  "TENANT_REQUIRED",
                  "FORBIDDEN",
                  "RATE_LIMITED",
                  "ACCOUNT_LOCKED",
                  "INTERNAL_SERVER_ERROR"
                ]
              }
            ],
            "modelRef": "#/components/schemas/ErrorResponse",
            "isExpanded": true
          }
        ]
      },
      {
        "statusCode": "500",
        "description": "Internal server error",
        "jsonExample": "",
        "isExpanded": true,
        "subExamples": [
          {
            "label": "GENERATED",
            "code": "// Internal server error\n{\n  \"error\": \"unauthorized\",\n  \"message\": \"Invalid username or password\",\n  \"code\": \"UNAUTHORIZED\"\n}"
          },
          {
            "label": "tokenGenerationFailed",
            "code": "// Token generation failed\n{\n  \"error\": \"internal_error\",\n  \"message\": \"Token generation failed\",\n  \"code\": \"INTERNAL_SERVER_ERROR\"\n}"
          },
          {
            "label": "serviceError",
            "code": "// Upstream service error\n{\n  \"error\": \"internal_error\",\n  \"message\": \"Failed to communicate with authentication backend\",\n  \"code\": \"INTERNAL_SERVER_ERROR\"\n}"
          }
        ],
        "schema": [
          {
            "kind": "optional",
            "type": "object",
            "description": "Standard error response format",
            "customType": "ErrorResponse",
            "schema": [
              {
                "name": "error",
                "kind": "required",
                "type": "string",
                "description": "<p>Error type identifier:</p>\n<ul>\n<li><code>invalid_request</code>: Malformed request or missing required fields</li>\n<li><code>unauthorized</code>: Invalid credentials or token</li>\n<li><code>account_not_verified</code>: Account exists but email/phone not verified</li>\n<li><code>session_expired</code>: Maximum session lifetime exceeded, full re-login required</li>\n<li><code>unauthorized_tenant</code>: User not authorized for requested tenant</li>\n<li><code>tenant_required</code>: Multi-tenant user must specify tenant</li>\n<li><code>unauthorized_site</code>: User not authorized for requested site</li>\n<li><code>site_required</code>: Site context required for this operation</li>\n<li><code>no_authorized_sites</code>: User has no authorized sites</li>\n<li><code>forbidden</code>: Access denied (e.g., no authorized tenants)</li>\n<li><code>rate_limited</code>: Too many requests, try again later</li>\n<li><code>account_locked</code>: Account temporarily locked due to failed attempts</li>\n<li><code>internal_error</code>: Server-side error</li>\n</ul>",
                "example": "unauthorized"
              },
              {
                "name": "message",
                "kind": "required",
                "type": "string",
                "description": "<p>Human-readable error description</p>",
                "example": "Invalid username or password"
              },
              {
                "name": "code",
                "kind": "required",
                "type": "string<BAD_REQUEST | UNAUTHORIZED | UNAUTHORIZED_TENANT | TENANT_REQUIRED | FORBIDDEN | RATE_LIMITED | ACCOUNT_LOCKED | INTERNAL_SERVER_ERROR>",
                "description": "HTTP status code name",
                "example": "UNAUTHORIZED",
                "enum": [
                  "BAD_REQUEST",
                  "UNAUTHORIZED",
                  "UNAUTHORIZED_TENANT",
                  "TENANT_REQUIRED",
                  "FORBIDDEN",
                  "RATE_LIMITED",
                  "ACCOUNT_LOCKED",
                  "INTERNAL_SERVER_ERROR"
                ]
              }
            ],
            "modelRef": "#/components/schemas/ErrorResponse",
            "isExpanded": true
          }
        ]
      }
    ],
    "hasXCodeSamples": false,
    "examples": {
      "languages": [
        {
          "id": "8HhHFZrQ7PvlKN_CnOLKv",
          "language": "curl",
          "label": "cURL",
          "code": "curl --request POST \\\n     --url https://api.upstartcommerce.com/api/v1/auth/login \\\n     --header 'accept: application/json' \\\n     --header 'content-type: application/json' \\\n     --data-raw '{\n     \"username\": \"user@example.com\",\n     \"password\": \"securePassword123\",\n     \"tokenType\": \"consumer\"\n     }'"
        },
        {
          "id": "piTNe12i-mlECWCX39LmA",
          "language": "javascript",
          "label": "javascript",
          "code": "var myHeaders = new Headers();\nmyHeaders.append(\"accept\", \"application/json\");\nmyHeaders.append(\"content-type\", \"application/json\");\n\nvar raw = JSON.stringify({\n   \"username\": \"user@example.com\",\n   \"password\": \"securePassword123\",\n   \"tokenType\": \"consumer\"\n});\n\nvar requestOptions = {\n   method: 'POST',\n   headers: myHeaders,\n   body: raw,\n   redirect: 'follow'\n};\n\nfetch(\"https://api.upstartcommerce.com/api/v1/auth/login\", requestOptions)\n   .then(response => response.text())\n   .then(result => console.log(result))\n   .catch(error => console.log('error', error));"
        },
        {
          "id": "suK4iMsXuLfwY9PMdXXia",
          "language": "ruby",
          "label": "Ruby",
          "code": "require \"uri\"\nrequire \"json\"\nrequire \"net/http\"\n\nurl = URI(\"https://api.upstartcommerce.com/api/v1/auth/login\")\n\nhttps = Net::HTTP.new(url.host, url.port)\nhttps.use_ssl = true\n\nrequest = Net::HTTP::Post.new(url)\nrequest[\"accept\"] = \"application/json\"\nrequest[\"content-type\"] = \"application/json\"\nrequest.body = JSON.dump({\n   \"username\": \"user@example.com\",\n   \"password\": \"securePassword123\",\n   \"tokenType\": \"consumer\"\n})\n\nresponse = https.request(request)\nputs response.read_body\n"
        },
        {
          "id": "TFV7dFPGFt2tXRQaq4QJj",
          "language": "python",
          "label": "Python",
          "code": "import requests\nimport json\n\nurl = \"https://api.upstartcommerce.com/api/v1/auth/login\"\n\npayload = json.dumps({\n   \"username\": \"user@example.com\",\n   \"password\": \"securePassword123\",\n   \"tokenType\": \"consumer\"\n})\nheaders = {\n   'accept': 'application/json',\n   'content-type': 'application/json'\n}\n\nresponse = requests.request(\"POST\", url, headers=headers, data=payload)\n\nprint(response.text)\n"
        }
      ],
      "selectedLanguageId": "8HhHFZrQ7PvlKN_CnOLKv"
    },
    "results": {
      "languages": [
        {
          "id": "F1vCDX9nesihWEz7-GB4z",
          "language": "200",
          "code": "// Authentication result. Either:\n\nSuccessful authentication with tokens (mfaRequired=false or absent)\nMFA challenge required (mfaRequired=true)\n{\n  \"mfaRequired\": false,\n  \"accessToken\": \"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...\",\n  \"refreshToken\": \"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...\",\n  \"expiresIn\": 3600,\n  \"tokenType\": \"Bearer\",\n  \"mfaChallengeId\": \"ch_abc123xyz\",\n  \"mfaMethod\": \"totp\",\n  \"mfaExpiresIn\": 300,\n  \"mfaMaskedPhoneNumber\": \"***1234\"\n}",
          "subExamples": [
            {
              "label": "GENERATED",
              "code": "// Authentication result. Either:\n\nSuccessful authentication with tokens (mfaRequired=false or absent)\nMFA challenge required (mfaRequired=true)\n{\n  \"mfaRequired\": false,\n  \"accessToken\": \"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...\",\n  \"refreshToken\": \"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...\",\n  \"expiresIn\": 3600,\n  \"tokenType\": \"Bearer\",\n  \"mfaChallengeId\": \"ch_abc123xyz\",\n  \"mfaMethod\": \"totp\",\n  \"mfaExpiresIn\": 300,\n  \"mfaMaskedPhoneNumber\": \"***1234\"\n}"
            },
            {
              "label": "successfulLogin",
              "code": "// Successful login (no MFA)\n{\n  \"mfaRequired\": false,\n  \"accessToken\": \"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...\",\n  \"refreshToken\": \"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...\",\n  \"expiresIn\": 3600,\n  \"tokenType\": \"Bearer\"\n}"
            },
            {
              "label": "mfaRequired",
              "code": "// MFA verification required\n{\n  \"mfaRequired\": true,\n  \"mfaChallengeId\": \"ch_abc123xyz\",\n  \"mfaMethod\": \"totp\",\n  \"mfaExpiresIn\": 300\n}"
            }
          ]
        },
        {
          "id": "4TFikc1GRU8RMJ3eCrP6u",
          "language": "400",
          "code": "// Bad request - invalid JSON, missing fields, or tenant selection required\n{\n  \"error\": \"unauthorized\",\n  \"message\": \"Invalid username or password\",\n  \"code\": \"UNAUTHORIZED\"\n}",
          "subExamples": [
            {
              "label": "GENERATED",
              "code": "// Bad request - invalid JSON, missing fields, or tenant selection required\n{\n  \"error\": \"unauthorized\",\n  \"message\": \"Invalid username or password\",\n  \"code\": \"UNAUTHORIZED\"\n}"
            },
            {
              "label": "invalidRequest",
              "code": "// Invalid request body\n{\n  \"error\": \"invalid_request\",\n  \"message\": \"Failed to read request body\",\n  \"code\": \"BAD_REQUEST\"\n}"
            },
            {
              "label": "tenantRequired",
              "code": "// Tenant selection required\n{\n  \"error\": \"tenant_required\",\n  \"message\": \"Multiple tenants available; tenant selection required via x-upstart-tenant header\",\n  \"code\": \"TENANT_REQUIRED\"\n}"
            },
            {
              "label": "invalidTokenType",
              "code": "// Invalid token type\n{\n  \"error\": \"invalid_request\",\n  \"message\": \"Invalid token type. Must be 'consumer' or 'management'\",\n  \"code\": \"BAD_REQUEST\"\n}"
            }
          ]
        },
        {
          "id": "ZZUFNlQZLt_TM_ajHO4SC",
          "language": "401",
          "code": "// Invalid credentials\n{\n  \"error\": \"unauthorized\",\n  \"message\": \"Invalid username or password\",\n  \"code\": \"UNAUTHORIZED\"\n}"
        },
        {
          "id": "3qGdzHQEie_4fA6ZMZXJB",
          "language": "403",
          "code": "// Forbidden - unauthorized tenant or no authorized tenants\n{\n  \"error\": \"unauthorized\",\n  \"message\": \"Invalid username or password\",\n  \"code\": \"UNAUTHORIZED\"\n}",
          "subExamples": [
            {
              "label": "GENERATED",
              "code": "// Forbidden - unauthorized tenant or no authorized tenants\n{\n  \"error\": \"unauthorized\",\n  \"message\": \"Invalid username or password\",\n  \"code\": \"UNAUTHORIZED\"\n}"
            },
            {
              "label": "unauthorizedTenant",
              "code": "// Unauthorized tenant\n{\n  \"error\": \"unauthorized_tenant\",\n  \"message\": \"User is not authorized for tenant: tenant-xyz\",\n  \"code\": \"UNAUTHORIZED_TENANT\"\n}"
            },
            {
              "label": "noAuthorizedTenants",
              "code": "// No authorized tenants\n{\n  \"error\": \"forbidden\",\n  \"message\": \"User has no authorized tenants\",\n  \"code\": \"FORBIDDEN\"\n}"
            }
          ]
        },
        {
          "id": "mn64EBByh6uSVNy-vvUu9",
          "language": "500",
          "code": "// Internal server error\n{\n  \"error\": \"unauthorized\",\n  \"message\": \"Invalid username or password\",\n  \"code\": \"UNAUTHORIZED\"\n}",
          "subExamples": [
            {
              "label": "GENERATED",
              "code": "// Internal server error\n{\n  \"error\": \"unauthorized\",\n  \"message\": \"Invalid username or password\",\n  \"code\": \"UNAUTHORIZED\"\n}"
            },
            {
              "label": "tokenGenerationFailed",
              "code": "// Token generation failed\n{\n  \"error\": \"internal_error\",\n  \"message\": \"Token generation failed\",\n  \"code\": \"INTERNAL_SERVER_ERROR\"\n}"
            },
            {
              "label": "serviceError",
              "code": "// Upstream service error\n{\n  \"error\": \"internal_error\",\n  \"message\": \"Failed to communicate with authentication backend\",\n  \"code\": \"INTERNAL_SERVER_ERROR\"\n}"
            }
          ]
        }
      ],
      "selectedLanguageId": "F1vCDX9nesihWEz7-GB4z"
    }
  },
  "children": [
    {
      "text": ""
    }
  ]
}