Obtain authentication token

Step 1 of the two-step login flow.

Reference

POST https://YOUR-NETWORK-DOMAIN/rest-api/auth/token.do

Step 1 of the two-step login flow. Validates the provided username and password, then returns a one-time authentication token that can be used with GET /rest-api/auth/{authToken}/login.do to establish a session. The token is valid for one minute and is invalidated after a single use. Requires HTTPS unless the network allows this login over plain HTTP. On success, the response JSON contains 'authToken' (the token string) and 'role' (the user's ACL role name). IP whitelist checks and brute-force protection are enforced: repeated failures are temporarily refused. An unknown username, a wrong password, an inactive account and an address outside the whitelist all get the same answer.

Form Params

username string required

The username of the account to authenticate. Must correspond to an existing active user.

john.doe

password string required

The user's password.

s3cur3P@ss

Responses

200

Token generated successfully. Response JSON: {success: true, authToken: '...', role: '...'}.

400

Bad request — invalid or missing parameters

401

Wrong username or password, an address outside the user's IP whitelist, or too many failed attempts: {success: false, error: '...', authToken: ''}.

403

Plain HTTP where the server requires HTTPS: {success: false, error: '...'}.

Language

cURL Request

curl --request POST \
  --url 'https://YOUR-NETWORK-DOMAIN/rest-api/auth/token.do' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'username=john.doe' \
  --data-urlencode 'password=s3cur3P@ss'

Python Request

import requests

response = requests.request("POST", "https://YOUR-NETWORK-DOMAIN/rest-api/auth/token.do", data={"username": "john.doe", "password": "s3cur3P@ss"})
print(response.json())

Node Request

const response = await fetch('https://YOUR-NETWORK-DOMAIN/rest-api/auth/token.do', {
  method: 'POST',
  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
  body: new URLSearchParams({"username":"john.doe","password":"s3cur3P@ss"}),
});

console.log(await response.json());

Java Request

HttpClient client = HttpClient.newHttpClient();

HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://YOUR-NETWORK-DOMAIN/rest-api/auth/token.do"))
    .header("Content-Type", "application/x-www-form-urlencoded")
    .method("POST", HttpRequest.BodyPublishers.ofString("username=john.doe&password=s3cur3P%40ss"))
    .build();

HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());

C# Request

using var client = new HttpClient();

var request = new HttpRequestMessage(new HttpMethod("POST"), "https://YOUR-NETWORK-DOMAIN/rest-api/auth/token.do");
request.Content = new FormUrlEncodedContent(new Dictionary<string, string> { ["username"] = "john.doe", ["password"] = "s3cur3P@ss" });

var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());

Go Request

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	req, _ := http.NewRequest("POST", "https://YOUR-NETWORK-DOMAIN/rest-api/auth/token.do", strings.NewReader(`username=john.doe&password=s3cur3P%40ss`))
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")

	res, _ := http.DefaultClient.Do(req)
	defer res.Body.Close()

	out, _ := io.ReadAll(res.Body)
	fmt.Println(string(out))
}

PHP Request

<?php
$ch = curl_init("https://YOUR-NETWORK-DOMAIN/rest-api/auth/token.do");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Content-Type: application/x-www-form-urlencoded"]);
curl_setopt($ch, CURLOPT_POSTFIELDS, 'username=john.doe&password=s3cur3P%40ss');

echo curl_exec($ch);
curl_close($ch);

Ruby Request

require 'net/http'
require 'json'

uri = URI("https://YOUR-NETWORK-DOMAIN/rest-api/auth/token.do")
request = Net::HTTP::Post.new(uri)
request['Content-Type'] = 'application/x-www-form-urlencoded'
request.set_form_data('username' => "john.doe", 'password' => "s3cur3P@ss")

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |http| http.request(request) }
puts response.body