Log in and obtain tokens

POST

/api/v1/auth/login

curl --request POST \
  --url https://api.aletheia-ops.com/api/v1/auth/login \
  --header 'Content-Type: application/json' \
  --data '{ "email": "example", "password": "example" }'

• Production
• Local development

Request Body^required

Media typeapplication/json

Authenticates an existing user

object

email

required

string

password

required

string

Example^generated

{
  "email": "example",
  "password": "example"
}

Responses

200

OK

Media typeapplication/json

Token-issuance response for signup/login/refresh/accept

object

access_token

string

refresh_token

string

access_expires_at

string format: date-time

refresh_expires_at

string format: date-time

user

Public shape of a user account (never includes the password hash)

object

id

string

email

string

name

string

status

string

created_at

string format: date-time

organization

Public shape of an organization

object

id

string

name

string

slug

string

settings

object

key

additional properties

any

created_at

string format: date-time

updated_at

string format: date-time

roles

Array<string>

Example^generated

{
  "access_token": "example",
  "refresh_token": "example",
  "access_expires_at": "2026-04-15T12:00:00Z",
  "refresh_expires_at": "2026-04-15T12:00:00Z",
  "user": {
    "id": "example",
    "email": "example",
    "name": "example",
    "status": "example",
    "created_at": "2026-04-15T12:00:00Z"
  },
  "organization": {
    "id": "example",
    "name": "example",
    "slug": "example",
    "settings": {},
    "created_at": "2026-04-15T12:00:00Z",
    "updated_at": "2026-04-15T12:00:00Z"
  },
  "roles": [
    "example"
  ]
}

400

The request is malformed or fails validation.

Media typeapplication/json

object

code

required

Stable, machine-readable identifier. Branch on this.

string

message

required

Human-readable explanation. Safe to display; do not parse.

string

Examples

{
  "code": "validation_failed",
  "message": "name: must not be blank"
}

{
  "code": "invalid_state",
  "message": "invalid or expired install state"
}

{
  "code": "unsafe_base_url",
  "message": "base URL is not permitted"
}

{
  "code": "invalid_body",
  "message": "could not read request body"
}

409

The request conflicts with the current state.

Media typeapplication/json

object

code

required

Stable, machine-readable identifier. Branch on this.

string

message

required

Human-readable explanation. Safe to display; do not parse.

string

Examples

{
  "code": "email_taken",
  "message": "an account with this email already exists"
}

{
  "code": "slug_taken",
  "message": "organization slug already taken"
}

{
  "code": "name_taken",
  "message": "a connection with this name already exists"
}

{
  "code": "account_exists",
  "message": "this AWS account is already connected"
}

{
  "code": "connection_exists",
  "message": "a connection for this organization already exists"
}

{
  "code": "scan_conflict",
  "message": "an equivalent scan is already queued or running"
}

{
  "code": "invitation_invalid",
  "message": "this invitation is no longer valid"
}

{
  "code": "last_admin",
  "message": "the organization must keep at least one active platform administrator"
}

{
  "code": "conflict",
  "message": "a resource with this identifier already exists"
}

{
  "code": "turn_in_progress",
  "message": "a turn is already in progress on this conversation"
}

429

Too many attempts. Back off and retry.

Media typeapplication/json

object

code

required

Stable, machine-readable identifier. Branch on this.

string

message

required

Human-readable explanation. Safe to display; do not parse.

string

Examples

Examplerate_limited

{
  "code": "rate_limited",
  "message": "too many attempts; please try again later"
}

500

An unexpected failure. Diagnostic detail is logged server-side and deliberately not returned. Quote the X-Request-Id response header when reporting one.

Media typeapplication/json

object

code

required

Stable, machine-readable identifier. Branch on this.

string

message

required

Human-readable explanation. Safe to display; do not parse.

string

Examples

Exampleinternal_error

{
  "code": "internal_error",
  "message": "internal server error"
}