Skip to content
SoundSyncAudio software platform

API reference

Accounts and Recovery API

Registration, verification, session identity, password recovery, profile changes and current-password changes.

Start with getting startedExplore API docs

Account identity and workspace access are different

An account token identifies a signed-in user. Developer permissions, assigned products, customer ownership and intended-recipient invitations are still checked by the relevant operation. Never substitute a developer JWT, library token, partner credential or product key for one another.

SoundSync

Account lifecycle operations

POST /api/auth/register

Create an account and request email verification

Auth
Public request; operation-specific verification still applies
Scope
The operation-specific account, workspace, product and ownership checks apply.
Request fields
  • email: string (required)
  • password: string (required)
  • firstName: string
  • lastName: string
  • role: customer | developer
  • account_type: customer | platform
  • storefrontSlug: string
  • company_name: string
  • website_url: string
  • support_email: string
  • support_url: string
  • business_address: string
  • tax_id: string
  • brand_color: string
  • dark_mode: boolean
  • custom_domain: string
  • billing_email: string
  • partnerInviteToken: string
  • programInviteToken: string
  • marketingOptIn: boolean
  • marketingOptOut: boolean
  • logo: string
Returns
HTTP 202: ok, code, status, emailVerificationRequired, emailSent, message, user.
Notes
Registration creates an unverified account, not a signed-in session. The optional logo is a multipart file. Account role and invitations are validated by the server; protected signup configurations can reject registration. A failed marketing-choice save can return 503 with accountCreated: true; do not create another account.
Request, response and error reference

Request (application/json or multipart/form-data)

{
  "type": "object",
  "properties": {
    "email": {
      "type": "string",
      "format": "email"
    },
    "password": {
      "type": "string",
      "minLength": 1
    },
    "firstName": {
      "type": "string"
    },
    "lastName": {
      "type": "string"
    },
    "role": {
      "type": "string",
      "enum": [
        "customer",
        "developer"
      ]
    },
    "account_type": {
      "type": "string",
      "enum": [
        "customer",
        "platform"
      ]
    },
    "storefrontSlug": {
      "type": "string"
    },
    "company_name": {
      "type": "string"
    },
    "website_url": {
      "type": "string"
    },
    "support_email": {
      "type": "string",
      "format": "email"
    },
    "support_url": {
      "type": "string"
    },
    "business_address": {
      "type": "string"
    },
    "tax_id": {
      "type": "string"
    },
    "brand_color": {
      "type": "string"
    },
    "dark_mode": {
      "type": "boolean"
    },
    "custom_domain": {
      "type": "string"
    },
    "billing_email": {
      "type": "string",
      "format": "email"
    },
    "partnerInviteToken": {
      "type": "string"
    },
    "programInviteToken": {
      "type": "string"
    },
    "marketingOptIn": {
      "type": "boolean"
    },
    "marketingOptOut": {
      "type": "boolean"
    },
    "logo": {
      "type": "string",
      "format": "binary"
    }
  },
  "required": [
    "email",
    "password"
  ],
  "additionalProperties": true
}

HTTP 202 response (application/json)

{
  "type": "object",
  "properties": {
    "ok": {
      "type": "boolean"
    },
    "code": {
      "type": "string"
    },
    "status": {
      "type": "string"
    },
    "emailVerificationRequired": {
      "type": "boolean"
    },
    "emailSent": {
      "type": "boolean"
    },
    "message": {
      "type": "string"
    },
    "user": {
      "type": "object",
      "properties": {
        "id": {
          "type": "integer",
          "minimum": 1
        },
        "email": {
          "type": "string",
          "format": "email"
        },
        "first_name": {
          "type": [
            "string",
            "null"
          ]
        },
        "last_name": {
          "type": [
            "string",
            "null"
          ]
        },
        "firstName": {
          "type": [
            "string",
            "null"
          ]
        },
        "lastName": {
          "type": [
            "string",
            "null"
          ]
        },
        "role": {
          "type": "string"
        },
        "is_reseller": {
          "type": "boolean"
        },
        "phone": {
          "type": [
            "string",
            "null"
          ]
        },
        "avatarUrl": {
          "type": [
            "string",
            "null"
          ]
        }
      },
      "additionalProperties": true
    }
  },
  "additionalProperties": true
}

Documented failures: 400, 500.

GET /api/auth/verify-email

Consume an account verification link and display HTML

Auth
Public request; operation-specific verification still applies
Scope
The operation-specific account, workspace, product and ownership checks apply.
Request fields
  • query token: string (required)
  • query storefrontSlug: string
  • query program_invite: string
Returns
HTTP 200: text/html.
Notes
Consumes a private one-use verification token and returns HTML, including on POST. Successful verification does not create a signed-in session. Open the supported sign-in continuation; never poll, log or share a verification URL. Missing/expired/used tokens return 400 HTML, not the generic JSON error model.
Request, response and error reference

Query and header parameters

[
  {
    "name": "token",
    "in": "query",
    "schema": {
      "type": "string"
    },
    "required": true,
    "description": ""
  },
  {
    "name": "storefrontSlug",
    "in": "query",
    "schema": {
      "type": "string"
    },
    "required": false,
    "description": ""
  },
  {
    "name": "program_invite",
    "in": "query",
    "schema": {
      "type": "string"
    },
    "required": false,
    "description": ""
  }
]

No request body fields are read by this operation.

HTTP 200 response (text/html)

{
  "type": "string"
}

Documented failures: 400, 500.

POST /api/auth/verify-email

Consume an account verification token and return HTML

Auth
Public request; operation-specific verification still applies
Scope
The operation-specific account, workspace, product and ownership checks apply.
Request fields
  • token: string (required)
  • storefrontSlug: string
  • program_invite: string
Returns
HTTP 200: text/html.
Notes
Consumes a private one-use verification token and returns HTML, including on POST. Successful verification does not create a signed-in session. Open the supported sign-in continuation; never poll, log or share a verification URL. Missing/expired/used tokens return 400 HTML, not the generic JSON error model.
Request, response and error reference

Request (application/json)

{
  "type": "object",
  "properties": {
    "token": {
      "type": "string"
    },
    "storefrontSlug": {
      "type": "string"
    },
    "program_invite": {
      "type": "string"
    }
  },
  "required": [
    "token"
  ],
  "additionalProperties": true
}

HTTP 200 response (text/html)

{
  "type": "string"
}

Documented failures: 400, 500.

POST /api/auth/forgot-password

Request account password recovery

Auth
Public request; operation-specific verification still applies
Scope
The operation-specific account, workspace, product and ownership checks apply.
Request fields
  • email: string (required)
  • account_type: customer | platform
  • storefrontSlug: string
  • resetBaseUrl: string
  • origin: string
  • programInviteToken: string
Returns
HTTP 200: message, code.
Notes
The response does not disclose whether the email has an account. A storefront context selects customer recovery; invitation recovery requires account_type. Reset delivery is separate from this HTTP success.
Request, response and error reference

Request (application/json)

{
  "type": "object",
  "properties": {
    "email": {
      "type": "string",
      "format": "email"
    },
    "account_type": {
      "type": "string",
      "enum": [
        "customer",
        "platform"
      ]
    },
    "storefrontSlug": {
      "type": "string"
    },
    "resetBaseUrl": {
      "type": "string"
    },
    "origin": {
      "type": "string"
    },
    "programInviteToken": {
      "type": "string"
    }
  },
  "required": [
    "email"
  ],
  "additionalProperties": true
}

HTTP 200 response (application/json)

{
  "type": "object",
  "properties": {
    "message": {
      "type": "string"
    },
    "code": {
      "type": "string"
    }
  },
  "additionalProperties": true
}

Documented failures: 400, 500.

POST /api/auth/reset-password

Consume a private one-time reset token

Auth
Public request; operation-specific verification still applies
Scope
The operation-specific account, workspace, product and ownership checks apply.
Request fields
  • token: string (required)
  • newPassword: string (required)
  • programInviteToken: string
Returns
HTTP 200: message, code.
Notes
Aliases resetToken/reset_token and password are accepted. The token is private and one-use; a successful reset revokes sessions. Invalid or expired tokens do not create a session.
Request, response and error reference

Request (application/json)

{
  "type": "object",
  "properties": {
    "token": {
      "type": "string"
    },
    "newPassword": {
      "type": "string",
      "minLength": 8
    },
    "programInviteToken": {
      "type": "string"
    }
  },
  "required": [
    "token",
    "newPassword"
  ],
  "additionalProperties": true
}

HTTP 200 response (application/json)

{
  "type": "object",
  "properties": {
    "message": {
      "type": "string"
    },
    "code": {
      "type": "string"
    }
  },
  "additionalProperties": true
}

Documented failures: 400, 500.

POST /api/auth/logout

Revoke the presented account session

Auth
Account Bearer JWT
Scope
The operation-specific account, workspace, product and ownership checks apply.
Returns
HTTP 200: ok.
Notes
Revokes the presented account session, not every account session. A failed session deletion returns 503 SESSION_REVOCATION_UNAVAILABLE; it is not a completed sign-out. Retry instead of assuming server revocation from client-side token removal.
Request, response and error reference

No request body fields are read by this operation.

HTTP 200 response (application/json)

{
  "type": "object",
  "properties": {
    "ok": {
      "type": "boolean"
    }
  },
  "additionalProperties": true
}

Documented failures: 401, 500, 503.

Operation errors: SESSION_REVOCATION_UNAVAILABLE.

GET /api/auth/me

Read the signed-in account

Auth
Account Bearer JWT
Scope
The operation-specific account, workspace, product and ownership checks apply.
Returns
HTTP 200: user.
Notes
Returns the current account, not a customer list or developer workspace authorization.
Request, response and error reference

No request body fields are read by this operation.

HTTP 200 response (application/json)

{
  "type": "object",
  "properties": {
    "user": {
      "type": "object",
      "properties": {
        "id": {
          "type": "integer",
          "minimum": 1
        },
        "email": {
          "type": "string",
          "format": "email"
        },
        "first_name": {
          "type": [
            "string",
            "null"
          ]
        },
        "last_name": {
          "type": [
            "string",
            "null"
          ]
        },
        "firstName": {
          "type": [
            "string",
            "null"
          ]
        },
        "lastName": {
          "type": [
            "string",
            "null"
          ]
        },
        "role": {
          "type": "string"
        },
        "is_reseller": {
          "type": "boolean"
        },
        "phone": {
          "type": [
            "string",
            "null"
          ]
        },
        "avatarUrl": {
          "type": [
            "string",
            "null"
          ]
        }
      },
      "additionalProperties": true
    }
  },
  "additionalProperties": true
}

Documented failures: 400, 500, 503.

PUT /api/account/profile

Update profile details or request an email change

Auth
Account Bearer JWT
Scope
The signed-in personal account only; not an effective developer workspace or product assignment.
Request fields
  • firstName: string,null
  • lastName: string,null
  • phone: string,null
  • email: string
  • avatarUrl: string,null
Returns
HTTP 200: message, emailChangeRequested, emailDelivery, user.
Notes
Names can be cleared independently. An email change requires verification; this response is not proof that the email changed. first_name, last_name and avatar_url aliases are accepted. Issued invoices and sent messages are not rewritten.
Request, response and error reference

Request (application/json)

{
  "type": "object",
  "properties": {
    "firstName": {
      "type": [
        "string",
        "null"
      ]
    },
    "lastName": {
      "type": [
        "string",
        "null"
      ]
    },
    "phone": {
      "type": [
        "string",
        "null"
      ]
    },
    "email": {
      "type": "string",
      "format": "email"
    },
    "avatarUrl": {
      "type": [
        "string",
        "null"
      ]
    }
  },
  "additionalProperties": true
}

HTTP 200 response (application/json)

{
  "type": "object",
  "properties": {
    "message": {
      "type": "string"
    },
    "emailChangeRequested": {
      "type": "boolean"
    },
    "emailDelivery": {
      "type": "object",
      "additionalProperties": true,
      "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
    },
    "user": {
      "type": "object",
      "properties": {
        "id": {
          "type": "integer",
          "minimum": 1
        },
        "email": {
          "type": "string",
          "format": "email"
        },
        "first_name": {
          "type": [
            "string",
            "null"
          ]
        },
        "last_name": {
          "type": [
            "string",
            "null"
          ]
        },
        "firstName": {
          "type": [
            "string",
            "null"
          ]
        },
        "lastName": {
          "type": [
            "string",
            "null"
          ]
        },
        "role": {
          "type": "string"
        },
        "is_reseller": {
          "type": "boolean"
        },
        "phone": {
          "type": [
            "string",
            "null"
          ]
        },
        "avatarUrl": {
          "type": [
            "string",
            "null"
          ]
        }
      },
      "additionalProperties": true
    }
  },
  "additionalProperties": true
}

Documented failures: 400, 500, 503.

POST /api/account/update-password

Change the password using the current password

Auth
Account Bearer JWT
Scope
The signed-in personal account only; not an effective developer workspace or product assignment.
Request fields
  • currentPassword: string
  • oldPassword: string
  • newPassword: string (required)
Returns
HTTP 200: message, code.
Notes
Send currentPassword (or oldPassword) and newPassword. Password verification, replacement and other-session revocation run in one transaction. If revocation fails, the password change rolls back and the request fails. The recognized current token is retained where present; with no current token all account sessions are revoked.
Request, response and error reference

Request (application/json)

{
  "type": "object",
  "properties": {
    "currentPassword": {
      "type": "string"
    },
    "oldPassword": {
      "type": "string"
    },
    "newPassword": {
      "type": "string",
      "minLength": 8
    }
  },
  "required": [
    "newPassword"
  ],
  "additionalProperties": true
}

HTTP 200 response (application/json)

{
  "type": "object",
  "properties": {
    "message": {
      "type": "string"
    },
    "code": {
      "type": "string"
    }
  },
  "additionalProperties": true
}

Documented failures: 400, 500, 503.

POST /api/account/email-change/verify

Verify an email change and return JSON

Auth
Public request; operation-specific verification still applies
Scope
The operation-specific account, workspace, product and ownership checks apply.
Request fields
  • token: string (required)
Returns
HTTP 200: message, email.
Notes
The private email token authorizes confirmation without a login session. JSON requests return JSON; browser form submissions return HTML with the same outcome. Reconfirming a completed change succeeds only while that address is still current. Expired, replaced or cancelled links cannot change the address; request a new link from the account.
Request, response and error reference

Request (application/json or application/x-www-form-urlencoded)

{
  "type": "object",
  "properties": {
    "token": {
      "type": "string"
    }
  },
  "required": [
    "token"
  ],
  "additionalProperties": true
}

HTTP 200 response (application/json)

{
  "type": "object",
  "properties": {
    "message": {
      "type": "string"
    },
    "email": {
      "type": "string",
      "format": "email"
    }
  },
  "additionalProperties": true
}

HTTP 200 response (text/html)

{
  "type": "string"
}

Error response formats: application/json or text/html.

Documented failures: 400, 404, 409, 410, 500.

GET /api/account/email-change/verify

Open the email-change verification page

Auth
Public request; operation-specific verification still applies
Scope
The operation-specific account, workspace, product and ownership checks apply.
Request fields
  • query token: string (required)
Returns
HTTP 200: text/html.
Notes
Shows a confirmation form without consuming the token or changing the email. GET and HEAD are safe for email scanners. The customer must submit Confirm email change; token validity and email conflicts are checked by POST. Responses are not cached.
Request, response and error reference

Query and header parameters

[
  {
    "name": "token",
    "in": "query",
    "schema": {
      "type": "string"
    },
    "required": true,
    "description": ""
  }
]

No request body fields are read by this operation.

HTTP 200 response (text/html)

{
  "type": "string"
}

Documented failures: 400, 500.

Verify the account, then sign in

Registration requests verification; it does not create a signed-in session. GET and POST /api/auth/verify-email consume the private token and return HTML rather than JSON. Follow the supported sign-in continuation after verification. A consumed, missing or expired token returns an error page; do not create another account or poll the verification link.

Recover without exposing account existence

Password-reset request responses do not confirm that the address has an account. Send the intended customer/storefront or platform context. Reset tokens and verification links are private, expire under their configured policy and must not be logged or published.

Registration returns 202 and an email-verification state, not a logged-in session. Check emailSent separately. An email/profile change is not verified until the supported verification step succeeds. Changing a password requires the current password; reset uses the private reset token instead.

SoundSync

Illustrative password recovery

Request a customer reset for your storefront 
curl --fail-with-body -sS -X POST "$SOUNDSYNC_API_BASE/api/auth/forgot-password" \
  -H "Content-Type: application/json" \
  --data '{"email":"customer@example.com","account_type":"customer","storefrontSlug":"your-store"}'

Evidence and sensitive responses

These contracts are reviewed against source and synthetic tests, not live requests against customer accounts. Treat account tokens, reset tokens, verification links, authenticator secrets, recovery codes and private profile information as confidential. Provider delivery and account mutations are not exercised by opening this reference.

Branded storefront session handoff

The signed-in customer can POST /api/auth/storefront-bridge/issue with the allowed published storefront origin and optional storefrontSlug. The returned bridgeToken is private, single-use, origin-bound and expires after five minutes. It is not a developer token or a public account lookup.

POST /api/auth/storefront-bridge/redeem exchanges that token at the matching origin for a saved customer session. If both header Origin and body origin are present, they must match. An expired or consumed token returns BRIDGE_TOKEN_INVALID. A later failure can consume the bridge before session creation finishes: obtain a new bridge from the existing signed-in account rather than replaying it. Check that the browser stored the returned session before navigating into the account.

Program invitation verification and legacy login

POST /api/auth/partner-program-verification accepts email and the private programInviteToken to request another account-verification message. The generic success message does not disclose account existence, acceptance or delivery. Invitation terms, identity, expiry, moderation and resend cooldown still apply.

GET /api/auth/hise-login is a legacy compatibility alias, not a JUCE requirement. It shares the normal login limit. New HISE, JUCE and custom clients should use POST /api/auth/login with JSON and finish any MFA challenge there. Do not put passwords in URLs; do not copy old query-based examples into new integrations.

SoundSync

Prepare a private customer handoff

Illustrative first-party issue request 
curl --fail-with-body -sS -X POST "$SOUNDSYNC_API_BASE/api/auth/storefront-bridge/issue" \
  -H "Authorization: Bearer $CUSTOMER_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"origin":"https://store.example","storefrontSlug":"example-store"}'

# Use the actual allowed origin and slug. Keep the returned bridgeToken private.
# Redeem it once at the matching storefront using the documented JSON contract.

SoundSync

Requests and responses

POST /api/auth/storefront-bridge/issue

Prepare a customer session handoff to a branded storefront

Auth
Account Bearer JWT
Scope
Verified customer account session and an allowed published storefront origin. Not developer workspace access.
Request fields
  • origin: string (required)
  • storefrontSlug: string
Returns
HTTP 200: bridgeToken, expiresAt, origin, storefrontSlug.
Notes
First-party customer sign-in handoff. Issues a private, origin-bound, single-use token with a five-minute lifetime. Storefront slug aliases are supported. This creates a bridge record; it is not a zero-write readiness probe. Never publish the token or send it to another origin.
Request, response and error reference

Request (application/json)

{
  "type": "object",
  "properties": {
    "origin": {
      "type": "string"
    },
    "storefrontSlug": {
      "type": "string"
    }
  },
  "required": [
    "origin"
  ],
  "additionalProperties": true
}

HTTP 200 response (application/json)

{
  "type": "object",
  "properties": {
    "bridgeToken": {
      "type": "string"
    },
    "expiresAt": {
      "type": [
        "string",
        "null"
      ],
      "format": "date-time"
    },
    "origin": {
      "type": "string"
    },
    "storefrontSlug": {
      "type": "string"
    }
  },
  "additionalProperties": true
}

Documented failures: 400, 401, 403, 404, 409, 500, 503.

Operation errors: CUSTOMER_SESSION_REQUIRED, STOREFRONT_ORIGIN_NOT_ALLOWED.

POST /api/auth/storefront-bridge/redeem

Exchange a private handoff token for a storefront customer session

Auth
Public request; operation-specific verification still applies
Scope
Private bridge token, its allowed origin and storefront. No account JWT is required for the exchange itself.
Request fields
  • bridgeToken: string (required)
  • origin: string (required)
  • storefrontSlug: string
Returns
HTTP 200: token, accessToken, customerToken, user, storefront.
Notes
Consumes the token atomically, checks the customer account and records a 30-day customer session. If an Origin header and body origin are both present, they must match. Expired or consumed tokens return 401. The exchange is not whole-workflow atomic: a later failure can consume the bridge without returning a session. Obtain a new bridge through the existing signed-in account instead of replaying it. An HTTP 200 does not prove the browser successfully stored the session.
Request, response and error reference

Request (application/json)

{
  "type": "object",
  "properties": {
    "bridgeToken": {
      "type": "string"
    },
    "origin": {
      "type": "string"
    },
    "storefrontSlug": {
      "type": "string"
    }
  },
  "required": [
    "bridgeToken",
    "origin"
  ],
  "additionalProperties": true
}

HTTP 200 response (application/json)

{
  "type": "object",
  "properties": {
    "token": {
      "type": "string"
    },
    "accessToken": {
      "type": "string"
    },
    "customerToken": {
      "type": "string"
    },
    "user": {
      "type": "object",
      "properties": {
        "id": {
          "type": "integer",
          "minimum": 1
        },
        "email": {
          "type": "string",
          "format": "email"
        },
        "first_name": {
          "type": [
            "string",
            "null"
          ]
        },
        "last_name": {
          "type": [
            "string",
            "null"
          ]
        },
        "firstName": {
          "type": [
            "string",
            "null"
          ]
        },
        "lastName": {
          "type": [
            "string",
            "null"
          ]
        },
        "role": {
          "const": "customer"
        }
      },
      "additionalProperties": true
    },
    "storefront": {
      "type": "object",
      "properties": {
        "developerId": {
          "type": "integer",
          "minimum": 1
        },
        "storefrontId": {
          "type": [
            "integer",
            "null"
          ]
        },
        "slug": {
          "type": "string"
        },
        "origin": {
          "type": "string"
        }
      },
      "additionalProperties": true
    }
  },
  "additionalProperties": true
}

Documented failures: 400, 401, 403, 404, 409, 500, 503.

Operation errors: BRIDGE_TOKEN_REQUIRED, BRIDGE_TOKEN_INVALID, STOREFRONT_BRIDGE_ORIGIN_MISMATCH, STOREFRONT_ORIGIN_NOT_ALLOWED, CUSTOMER_SESSION_UNAVAILABLE.

POST /api/auth/partner-program-verification

Request another verification email for an eligible program invitation

Auth
Public request; operation-specific verification still applies
Scope
Public invitation recovery; the private invitation must match an eligible unverified recipient account.
Request fields
  • email: string (required)
  • programInviteToken: string (required)
Returns
HTTP 200: message.
Notes
Rate-limited by IP and normalized email. Returns the same generic 200 message whether or not mail is queued; it does not disclose account existence or prove delivery. Checks invitation expiry, current terms, recipient identity, account status and cooldown. Does not accept an agreement, create earnings or sign in the recipient.
Request, response and error reference

Request (application/json)

{
  "type": "object",
  "properties": {
    "email": {
      "type": "string",
      "format": "email"
    },
    "programInviteToken": {
      "type": "string"
    }
  },
  "required": [
    "email",
    "programInviteToken"
  ],
  "additionalProperties": true
}

HTTP 200 response (application/json)

{
  "type": "object",
  "properties": {
    "message": {
      "type": "string"
    }
  },
  "additionalProperties": true
}

Documented failures: 429, 500.

GET /api/auth/hise-login

Legacy GET account login compatibility route

Auth
Public request; operation-specific verification still applies
Scope
Only the matching verified account. Legacy first-party compatibility, not a HISE requirement or recommended new integration.
Request fields
  • query email: string
  • query password: string
  • query role: string
  • query format: string
  • query hise_text: string
Returns
HTTP 200: token, accessToken, customerToken, user, twoFactorRequired, twoFactorToken, code, message.
Notes
Use POST /api/auth/login with a JSON body for all new clients, including JUCE. This alias shares the normal login rate-limit bucket. Legacy account/email/password query aliases are accepted, but URLs can expose credentials through logging and history; never put them in examples, screenshots or support reports. hise_text or format=hise_text returns the legacy text transport after successful sign-in. MFA challenges must be completed through the supported POST flow. Route presence does not imply that JUCE requires HISE authentication.
Request, response and error reference

Legacy operation. Use the current scoped APIs for new integrations.

Query and header parameters

[
  {
    "name": "email",
    "in": "query",
    "required": false,
    "schema": {
      "type": "string"
    }
  },
  {
    "name": "password",
    "in": "query",
    "required": false,
    "schema": {
      "type": "string"
    }
  },
  {
    "name": "role",
    "in": "query",
    "required": false,
    "schema": {
      "type": "string"
    }
  },
  {
    "name": "format",
    "in": "query",
    "required": false,
    "schema": {
      "type": "string"
    }
  },
  {
    "name": "hise_text",
    "in": "query",
    "required": false,
    "schema": {
      "type": "string"
    }
  }
]

No request body fields are read by this operation.

HTTP 200 response (application/json)

{
  "type": "object",
  "properties": {
    "token": {
      "type": "string"
    },
    "user": {
      "type": "object",
      "additionalProperties": true,
      "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
    },
    "twoFactorRequired": {
      "type": "boolean"
    },
    "twoFactorToken": {
      "type": "string"
    },
    "message": {
      "type": "string"
    }
  },
  "additionalProperties": true
}

HTTP 200 response (text/plain)

{
  "type": "string"
}

Documented failures: 400, 401, 403, 429, 500.