Login with authentication token

Authenticates a user using a one-time token previously obtained from POST /rest-api/auth/token.do.

Reference

GET https://YOUR-NETWORK-DOMAIN/rest-api/auth/{authToken}/login.do

Authenticates a user using a one-time token previously obtained from POST /rest-api/auth/token.do. The token is consumed on first use and expires after one minute. On success, a session is established and the response includes a 'redirectUrl' to the main application page. The response format depends on request parameters: if a 'callback' query parameter is present, the response is JSONP (application/javascript); if 'json=true', the response is plain JSON; otherwise, a 302 redirect to /index.do is issued. Only the redirect mode signs the user in when called from another site: open the URL as a top-level navigation. The session cookie is SameSite=Lax, so a cross-site <script> or XHR call in the JSONP or JSON mode reports success but the browser drops the cookie, and the token is spent. Brute-force protection is active -- repeated failed attempts may block the requesting IP.

Path Params

authToken string required

One-time authentication token obtained from POST /rest-api/auth/token.do. Valid for one minute and consumed on first use. A random 128-bit value as 32 hex characters.

a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4

Query Params

json boolean

If true, returns the result as JSON instead of performing a redirect. Defaults to false.

true

Responses

200

Authentication result (JSON/JSONP) containing 'success', 'redirectUrl', or 'error' fields

302

Redirect to /index.do (default mode when neither 'callback' nor 'json' are specified)

400

Bad request — invalid or missing parameters

404

Not found — resource does not exist

Language

cURL Request

curl --request GET \
  --url 'https://YOUR-NETWORK-DOMAIN/rest-api/auth/a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4/login.do?json=true'

Python Request

import requests

response = requests.request("GET", "https://YOUR-NETWORK-DOMAIN/rest-api/auth/a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4/login.do?json=true")
print(response.json())

Node Request

const response = await fetch('https://YOUR-NETWORK-DOMAIN/rest-api/auth/a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4/login.do?json=true', {
  method: 'GET',
});

console.log(await response.json());

Java Request

HttpClient client = HttpClient.newHttpClient();

HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://YOUR-NETWORK-DOMAIN/rest-api/auth/a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4/login.do?json=true"))
    .method("GET", HttpRequest.BodyPublishers.noBody())
    .build();

HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());

C# Request

using var client = new HttpClient();

var request = new HttpRequestMessage(new HttpMethod("GET"), "https://YOUR-NETWORK-DOMAIN/rest-api/auth/a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4/login.do?json=true");

var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());

Go Request

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, _ := http.NewRequest("GET", "https://YOUR-NETWORK-DOMAIN/rest-api/auth/a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4/login.do?json=true", nil)

	res, _ := http.DefaultClient.Do(req)
	defer res.Body.Close()

	out, _ := io.ReadAll(res.Body)
	fmt.Println(string(out))
}

PHP Request

<?php
$ch = curl_init("https://YOUR-NETWORK-DOMAIN/rest-api/auth/a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4/login.do?json=true");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "GET");

echo curl_exec($ch);
curl_close($ch);

Ruby Request

require 'net/http'
require 'json'

uri = URI("https://YOUR-NETWORK-DOMAIN/rest-api/auth/a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4/login.do?json=true")
request = Net::HTTP::Get.new(uri)

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |http| http.request(request) }
puts response.body