Login & Logout

Looking for the product view?

The Help Center explains this surface as users see it: Getting started.

Endpoints for creating and terminating user sessions.

POST /api/login/{domain}

Authenticate a user and create a new session.

Authentication: Tenant-level (no user session required)

Path Parameters:

Parameter	Type	Description
`domain`	string	Authentication domain (e.g., `local`, SAML provider ID)

Request Body:

Field	Type	Required	Description
`username`	string	Yes	Username (case-insensitive)
`password`	string	Yes (for local)	User password
`mfaConfig`	object	No	MFA configuration if enrolled
`mfaConfig.loginTicket`	string	No	Login ticket from MFA flow
`mfaConfig.code`	string	No	MFA verification code

Query Parameters:

Parameter	Type	Default	Description
`redirect`	boolean	false	Redirect to URL after login

Example Request (Local Auth):

{
  "username": "admin",
  "password": "secure-password"
}

Example Request (MFA Verification):

{
  "username": "admin",
  "mfaConfig": {
    "loginTicket": "jwt-login-ticket",
    "code": "123456"
  }
}

The sid cookie is also set on the response. Domains with MFA enabled answer with a loginTicket flow instead of a session (see MFA).

Request body

{
  "username": "admin",
  "password": "123"
}

Response · 200

{
  "_links": {
    "self": {
      "href": "https://informer.example.com/api/login/local"
    }
  },
  "sid": "00000000-0000-4000-8000-000000000001",
  "jwt": "eyJhbGciOiJIUzI1NiJ9.example-token-1.signature",
  "wsToken": "eyJhbGciOiJIUzI1NiJ9.example-token-2.signature",
  "locale": "en",
  "lang": "en",
  "_embedded": {
    "inf:user": {
      "_links": {
        "self": {
          "href": "https://informer.example.com/api/users/admin"
        },
        "inf:memberships": {
          "href": "https://informer.example.com/api/users/admin/memberships"
        },
        "inf:avatar-upload": {
          "href": "https://informer.example.com/api/users/admin/_upload/{uploadId}/avatar-upload",
          "templated": true
        },
        "inf:password": {
          "href": "https://informer.example.com/api/users/admin/password"
        },
        "inf:feed": {
          "href": "https://informer.example.com/api/users/admin/feed"
        },
        "inf:viewed-feed": {
          "href": "https://informer.example.com/api/users/admin/_markFeedViewed"
        },
        "inf:superuser": {
          "href": "https://informer.example.com/api/users/admin/superuser"
        }
      },
      "permissions": {
        "changeDomain": false,
        "changeProfile": true,
        "changePassword": true,
        "delete": false,
        "edit": true,
        "reassign": true,
        "superuser": true,
        "enable": true,
        "changeTheme": true,
        "lock": true,
        "setGlobalPermissions": true,
        "manageLogin": true
      },
      "domain": "local",
      "username": "admin",
      "displayName": "acme Administrator",
      "familyName": "Administrator",
      "givenName": "acme",
      "middleName": null,
      "email": null,
      "data": null,
      "superuser": true,
      "timezone": "America/New_York",
      "settings": {
        "log": {
          "log": false,
          "info": false,
          "warn": false,
          "debug": false,
          "error": true,
          "remote": false
        }
      },
      "enabled": true,
      "source": null,
      "sourceId": null,
      "lastViewedFeed": null,
      "tenant": "acme",
      "globalPermissions": {
        "ai": false,
        "jobCreation": true,
        "viewAllTeams": true,
        "viewAllUsers": true,
        "painlessScriptCreation": true
      },
      "userFields": {},
      "locked": false,
      "lockedAt": null,
      "loginAttempts": 0,
      "passwordSetAt": "2026-01-15T16:20:00.000Z",
      "passwordExpiresAt": "2026-01-15T16:20:00.000Z",
      "forgotPasswordRequestTime": null,
      "mfa": null,
      "mfaConfig": {},
      "aiMessage": null,
      "aiConsent": false,
      "hasSharedDatasources": false,
      "createdAt": "2026-01-15T16:20:00.000Z",
      "updatedAt": "2026-01-15T16:20:00.000Z",
      "initials": "NA",
      "colorIndex": 4,
      "avatarColor": {
        "background": "#81C784",
        "text": "#1B5E20"
      },
      "managesPassword": true
    }
  }
}

Captured from the API examples test suite; ids and timestamps are normalized.

Key Fields:

Field	Description
`sid`	The session id (also set as the session cookie)
`jwt` / `wsToken`	Signed tokens for API and websocket use by the clients
`locale` / `lang`	The user's resolved locale and language
`_embedded["inf:user"]`	The authenticated user (embedded, not a top-level `user` field)

MFA Response (Setup Required):

{
  "mfaConfigs": [
    {
      "id": "totp",
      "name": "Authenticator App",
      "setupComponent": "totp-setup",
      "qrCode": "data:image/png;base64,...",
      "secret": "BASE32SECRET"
    }
  ],
  "loginTicket": "jwt-ticket-for-mfa-completion"
}

MFA Response (Verification Required):

{
  "loginTicket": "jwt-ticket-for-mfa-verification",
  "verifyConfig": {
    "component": "totp-verify"
  }
}

Error Responses:

401 Unauthorized - Invalid credentials, account locked, or password expired
400 Bad Request - Invalid domain or missing required fields

Pre-blocks:

Login ticket verification (if provided)
Domain lookup and validation
MFA authenticator check
Passport strategy authentication
Domain coercion and user validation
License check (user count limit)
User find-or-create
MFA setup or verification
Session creation
Session credentials generation

Timeout: 2 minutes

Account Lockout

Failed login attempts increment a counter. After exceeding the configured limit (tenant setting loginAttemptsAllowed), the account is locked for the configured lockoutTime (in minutes).

Password Expiration

If a user's password has expired, they will receive a 401 error with message "Password must be reset". Use the forgot password flow to reset.

GET /api/login/{domain}

Authenticate via GET request (typically for SSO flows).

Authentication: Tenant-level

Path Parameters:

Parameter	Type	Description
`domain`	string	Authentication domain

Query Parameters:

Parameter	Type	Default	Description
`redirect`	boolean	false	Redirect to URL after login

Response:

Same as POST endpoint or redirect to SSO provider.

GET /api/login/{domain}/sso

Initiate SSO authentication flow (SAML).

Authentication: Tenant-level

Path Parameters:

Parameter	Type	Description
`domain`	string	SAML domain ID

Query Parameters:

Parameter	Type	Description
`redirectTo`	string	Relative path to redirect to after successful login

Response:

302 Redirect to SAML IdP entry point

Cookie Set:

Sets a short-lived cookie with redirect information that persists across the SAML roundtrip.

Example:

GET /api/login/saml-domain/sso?redirectTo=/datasets

POST /api/logout

Terminate the current session and clear cookies.

Authentication: Optional (mode: try)

Pre-blocks: Current session lookup

Log outPOST /api/logout

Responds 200 with an empty body, destroys the session, and clears the cookie. Logging out of an impersonated session restores the parent session instead.

Response · 200 · no body

Captured from the API examples test suite; ids and timestamps are normalized.

Side Effects:

Destroys the current session in database
Clears session cookie
If the session had a parent (impersonation), sets cookie to parent session

Example:

curl -X POST https://app.example.com/api/logout \
  -H "Cookie: sid=session-id-here"

Impersonation Support

If the current session is an impersonated session (has a parent), logging out will restore the parent session instead of fully logging out.

POST /api/login/{domain}​

GET /api/login/{domain}​

GET /api/login/{domain}/sso​

POST /api/logout​

POST /api/login/{domain}

GET /api/login/{domain}

GET /api/login/{domain}/sso

POST /api/logout