Operator login — email + password

POST

/operator/login

curl --request POST \
  --url http://localhost:3000/operator/login \
  --header 'Content-Type: application/json' \
  --data '{ "email": "hello@example.com", "password": "example" }'

Request Body^required

Media typeapplication/json

object

email

required

string format: email

<= 254 characters

password

required

string

>= 1 characters <= 1024 characters

Example^generated

{
  "email": "hello@example.com",
  "password": "example"
}

Responses

200

A session token and the operator’s public profile.

Media typeapplication/json

object

token

required

Operator session token. Bearer-authenticate with it as operatorToken.

string

expires_at

required

string format: date-time

operator

required

An operator as returned by login, invite acceptance, and GET /operator/me — the same shape everywhere so a dashboard hitting any of the three sees one model. Never carries password_hash.

object

id

required

string

name

required

string

email

required

string format: email

role

required

string

Allowed values: staff owner member

tenant_id

required

Null for platform staff.

string | null

Example

{
  "operator": {
    "role": "staff"
  }
}

400

Malformed body — not an email, missing password, or either field over its length bound. Rejected by validation before any credential is examined, so this is distinguishable from a failed login and says nothing about the account.

Media typeapplication/json

object

error

required

object

code

required

string

Allowed values: VALIDATION_FAILED UNAUTHENTICATED FORBIDDEN NOT_FOUND CONFLICT RATE_LIMITED INTERNAL

message

required

string

requestId

required

string

fields

Present only for VALIDATION_FAILED.

Array<object>

object

path

string

message

string

Example

{
  "error": {
    "code": "VALIDATION_FAILED"
  }
}

401

Unknown email, wrong password, a not-yet-accepted invite, or a disabled operator — all four answer identically, in the same time, so none is distinguishable from the others.

Media typeapplication/json

object

error

required

object

code

required

string

Allowed values: VALIDATION_FAILED UNAUTHENTICATED FORBIDDEN NOT_FOUND CONFLICT RATE_LIMITED INTERNAL

message

required

string

requestId

required

string

fields

Present only for VALIDATION_FAILED.

Array<object>

object

path

string

message

string

Example

{
  "error": {
    "code": "VALIDATION_FAILED"
  }
}

429

Rate limit exceeded.

Media typeapplication/json

object

error

required

object

code

required

string

Allowed values: VALIDATION_FAILED UNAUTHENTICATED FORBIDDEN NOT_FOUND CONFLICT RATE_LIMITED INTERNAL

message

required

string

requestId

required

string

fields

Present only for VALIDATION_FAILED.

Array<object>

object

path

string

message

string

Example

{
  "error": {
    "code": "VALIDATION_FAILED"
  }
}

Headers

Retry-After

integer