Login APIs - Home - FusionAuth

1. Overview

The following APIs are used to authenticate and track user logins.

Authenticate a User
Authenticate a User with a one time password
Complete Two Factor Authentication
Update Login Instant
Logout a User

The following APIs allow you to search and export historical login records.

Search Login Records
Export Login Records

2. Authenticate a User

The Login API is used authenticate a user in FusionAuth. The issuer of the One Time Password will dictate if a JWT or a Refresh Token may be issued in the API response.

2.1. Request

By default, this API will require authentication when called with an applicationId. Authentication may be disabled per Application, see application.loginConfiguration.requireAuthentication in the Application API or navigate to Applications Edit Security in the user interface.

Prior to version 1.5.0 this API did not accept an API key and never required authentication.

Authenticate a User

URI

POST /api/login

Table 1. Request Headers
X-Forwarded-For [String] Optional	The IP address of a client requesting authentication. If the IP address is provided it will be stored for login history of the user. It is generally preferred to specify the IP address in the request body. If it is not provided in the request body this header value will be used if available, the request body value will take precedence.

Table 2. Request Body
applicationId [UUID] Optional	The Id of the Application the user is to be logged into. If this parameter is omitted the user will still be authenticated but a login count will not be recorded for an Application.
device [String] Optional Deprecated	The unique device identifier for this request. This value should be unique to the device and the same device Id should be sent on subsequent requests for the same device. Using this parameter will indicate you wish to receive a refresh token on the response. The refresh token will be written on the HTTP response as an HTTP only persistent cookie named `refresh_token`, and also be provided in the JSON response body. Removed in version 1.5.0 This parameter is no longer required to receive a Refresh Token, if it is provided on the request it will be ignored. In version 1.5.0 and later Refresh Tokens are issued by the Login API based upon the Application configuration. See loginConfiguration.generateRefreshTokens settings in the Application API.
ipAddress [String] Optional	The IP address of the end-user that is logging into FusionAuth. If this value is omitted FusionAuth will attempt to obtain the IP address of the client, the value will be that of the `X-Forwarded-For` header if provided or the last proxy that sent the request. The IP address will be stored in the User login history.
loginId [String] Required	The login identifier of the user. The login identifier can be either the email or the username.
metaData.device.description [String] Optional	A human readable description of the device used during login. This meta data is used to describe the refresh token that may be generated for this login request.
metaData.device.name [String] Optional	A human readable name of the device used during login. This meta data is used to describe the refresh token that may be generated for this login request.
metaData.device.type [String] Optional	The type of device used during login. The following types may be specified: `BROWSER` `DESKTOP` `LAPTOP` `MOBILE` `OTHER` `SERVER` `TABLET` `TV` `UNKNOWN` This meta data is used to describe the refresh token that may be generated for this login request.
noJWT [Boolean] Optional defaults to `false`	When this value is set to true a JWT will not be issued as part of this request. The response body will not contain the `token` or `refreshToken` fields, and the `access_token` and `refresh_token` cookies will not be written to the HTTP response. This optional parameter may be helpful when performing high volume authentication requests and the JWT is not being utilized, in this scenario removing the additional latency required to issue and sign the JWT may have a measurable cumulative effect on performance.
password [String] Required	The user’s password or an Application specific Authentication Token.
twoFactorTrustId [String] Optional	The Two Factor Trust identifier returned by the Two Factor Login API response. This value be may be provided to bypass the Two Factor challenge when a User has Two Factor enabled.

Example Request JSON

{
  "loginId": "example@fusionauth.io",
  "password": "password",
  "applicationId": "10000000-0000-0002-0000-000000000001",
  "ipAddress": "192.168.1.42"
}

2.2. Response

The response for this API contains the User object.

Table 3. Response Codes
Code	Description
200	The authentication was successful. The response will contain the User object that was authenticated.
202	The user was authenticated successfully. The user is not registered for the application specified by `applicationId` on the request. The response will contain the User object that was authenticated.
203	The user was authenticated successfully. The user is required to change their password, the response will contain the `changePasswordId` to be used on the Change Password API. Example Response JSON `{ "changePasswordId": "XOgai4Ro68xfGiex0ngXiJ2bbhduM4Pm7h3lvF0xibQ" }`
212	The user’s email address has not yet been verified. The response will contain the User object that was authenticated.
242	The user was authenticated successfully. The user has two factor authentication enabled, the response will contain the `twoFactorId` to be used on the Complete Two Factor Authentication. Example Response JSON `{ "twoFactorId": "YkQY5Gsyo4RlfmDciBGRmvfj3RmatUqrbjoIZ19fmw4" }`
400	The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors.
401	You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication. By default, this API will require authentication when called with an `applicationId`. Authentication may be disabled per Application, see `application.loginConfiguration.requireAuthentication` in the Application API or the Security tab in the Application configuration. Prior to version `1.5.0` this API never require an API key.
404	The user was not found or the password was incorrect. The response will be empty.
409	The user is currently in an action that has prevented login. The response will contain the actions that prevented login. Example Response JSON `{ "actions": [ { "actionId": "00000000-0000-0000-0000-000000000042", "actionerUserId": "00000000-0000-0001-0000-000000000000", "expiry": 1571786483322, "localizedName": "Prevent Login Action", "localizedReason": "Hard Lock", "name": "Prevent Login Action", "reason": "Hard Lock", "reasonCode": "hard_lock" } ] }`
410	The user has expired. The response will be empty.
423	The user is locked and cannot login. The response will be empty. Prior to version 1.9.0 a 404 status code will be returned instead.
500	There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.
503	The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

Table 4. Response Body
refreshToken [String]	The refresh token that can be used to obtain a new access token once the provide one has expired.
state [Object]	If authenticated using a One Time Password and state was provided during the Change Password request this value will be returned exactly as it was provided.
token [String]	The access token, this string is an encoded JSON Web Token (JWT).
user.active [Boolean]	True if the User is active. False if the User has been deactivated. Deactivated Users will not be able to login.
user.birthDate [String]	The User’s birthdate formatted as `YYYY-MM-DD`
user.cleanSpeakId [UUID]	This Id is used by FusionAuth when the User’s username is sent to CleanSpeak to be moderated (filtered and potentially sent to the approval queue). It is the content Id of the username inside CleanSpeak.
user.data [Object]	An object that can hold any information about the User that should be persisted.
user.email [String]	The User’s email address.
user.expiry [Long]	The expiration instant of the User’s account. An expired user is not permitted to login.
user.firstName [String]	The first name of the User.
user.fullName [String]	The User’s full name as a separate field that is not calculated from firstName and lastName.
user.id [UUID]	The User’s unique Id.
user.imageUrl [String]	The URL that points to an image file that is the User’s profile image.
user.insertInstant [Long]	The instant when user was created.
user.lastLoginInstant [Long]	The instant when the User logged in last.
user.lastName [String]	The User’s last name.
user.middleName [String]	The User’s middle name.
user.mobilePhone [String]	The User’s mobile phone number. This is useful is you will be sending push notifications or SMS messages to the User.
user.passwordChangeRequired [Boolean]	Indicates that the User’s password needs to be changed during their next login attempt.
user.passwordLastUpdateInstant [Long]	The instant that the User last changed their password.
user.preferredLanguages [Array<String>]	An array of locale strings that give, in order, the User’s preferred languages. These are important for email templates and other localizable text. See Locales.
user.registrations [Array]	The list of registrations for the User.
user.registrations`[x]`.applicationId [UUID]	The Id of the Application that this registration is for.
user.registrations`[x]`.authenticationToken [String]	The Authentication Token for this registration (if one exists).
user.registrations`[x]`.cleanSpeakId [UUID]	This Id is used by FusionAuth when the User’s username for this registration is sent to CleanSpeak to be moderated (filtered and potentially sent to the approval queue). It is the content Id of the username inside CleanSpeak.
user.registrations`[x]`.data [Object]	An object that can hold any information about the User for this registration that should be persisted.
user.registrations`[x]`.id [UUID]	The Id of this registration.
user.registrations`[x]`.insertInstant [Long]	The instant that this registration was created.
user.registrations`[x]`.lastLoginInstant [Long]	The instant that the User last logged into the Application for this registration.
user.registrations`[x]`.preferredLanguages [Array<String>]	An array of locale strings that give, in order, the User’s preferred languages for this registration. These are important for email templates and other localizable text.
user.registrations`[x]`.roles [Array<String>]	The list of roles that the User has for this registration.
user.registrations`[x]`.timezone [String]	The User’s preferred timezone for this registration. The string will be in an IANA time zone format.
user.registrations`[x]`.tokens [Map<String,String>] Available Since 1.1.0	A map that contains tokens returned from identity providers. For example, if this user has authenticated using the Facebook Identity Provider, the Facebook access token will be available in this map, keyed by name `Facebook`. For an OpenID Connect Identity provider, or other generic providers, if a token is stored it will be keyed by the Identity Provider unique Id.
user.registrations`[x]`.username [String]	The username of the User for this registration only.
user.registrations`[x]`.usernameStatus [String]	The current status of the username. This is used if you are moderating usernames via CleanSpeak. The possible values are: `ACTIVE` - the username is active `PENDING` - the username is pending approval/moderation `REJECTED` - the username was rejected during moderation If a username has been rejected, it is still possible to allow the User to update it and have the new one moderated again.
user.registrations`[x]`.verified [Boolean]	This value indicates if this User’s registration has been verified.
user.timezone [String]	The User’s preferred timezone. This can be used as a default to display instants, and it is recommended that you allow User’s to change this per-session. The string will be in an IANA time zone format.
user.twoFactorDelivery [String]	The User’s preferred delivery for verification codes during a two factor login request. The possible values are: `None` `TextMessage`
user.twoFactorEnabled [Boolean]	Determines if the User has two factor authentication enabled for their account or not.
user.username [String]	The username of the User.
user.usernameStatus [String]	The current status of the username. This is used if you are moderating usernames via CleanSpeak. The possible values are: `ACTIVE` - the username is active `PENDING` - the username is pending approval/moderation `REJECTED` - the username was rejected during moderation If a username has been rejected, it is still possible to allow the User to update it and have the new one moderated again.
user.verified [Boolean]	Whether or not the User’s email has been verified.

Example Response JSON

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE0ODUxNDA5ODQsImlhdCI6MTQ4NTEzNzM4NCwiaXNzIjoiYWNtZS5jb20iLCJzdWIiOiIyOWFjMGMxOC0wYjRhLTQyY2YtODJmYy0wM2Q1NzAzMThhMWQiLCJhcHBsaWNhdGlvbklkIjoiNzkxMDM3MzQtOTdhYi00ZDFhLWFmMzctZTAwNmQwNWQyOTUyIiwicm9sZXMiOltdfQ.Mp0Pcwsz5VECK11Kf2ZZNF_SMKu5CgBeLN9ZOP04kZo",
  "user": {
    "active": true,
    "birthDate": "1976-05-30",
    "data": {
      "displayName": "Johnny Boy",
      "favoriteColors": [
        "Red",
        "Blue"
      ]
    },
    "email": "example@fusionauth.io",
    "expiry": 1571786483322,
    "firstName": "John",
    "fullName": "John Doe",
    "id": "00000000-0000-0001-0000-000000000000",
    "imageUrl": "http://65.media.tumblr.com/tumblr_l7dbl0MHbU1qz50x3o1_500.png",
    "lastLoginInstant": 1471786483322,
    "lastName": "Doe",
    "middleName": "William",
    "mobilePhone": "303-555-1234",
    "passwordChangeRequired": false,
    "passwordLastUpdateInstant": 1471786483322,
    "preferredLanguages": [
      "en",
      "fr"
    ],
    "registrations": [
      {
        "applicationId": "10000000-0000-0002-0000-000000000001",
        "data": {
          "displayName": "Johnny",
          "favoriteSports": [
            "Football",
            "Basketball"
          ]
        },
        "id": "00000000-0000-0002-0000-000000000000",
        "insertInstant": 1446064706250,
        "lastLoginInstant": 1456064601291,
        "preferredLanguages": [
          "en",
          "fr"
        ],
        "roles": [
          "user",
          "community_helper"
        ],
        "tokens": {
          "Facebook": "nQbbBIzDhMXXfa7iDUoonz5zS",
          "19544aa2-d634-4859-b193-e57af82b5d12": "eu1SsrjsiDf3h3LryUjxHIKTS0yyrbiPcsKF3HDp"
        },
        "username": "johnny123",
        "usernameStatus": "ACTIVE"
      }
    ],
    "timezone": "America/Denver",
    "twoFactorEnabled": false,
    "usernameStatus": "ACTIVE",
    "username": "johnny123",
    "verified": true
  }
}

Table 5. Response Cookies
access_token [String]	The encoded access token. This cookie is written in the response as an HTTP Only session cookie.
refresh_token [String]	The refresh token. This cookie is written in the response as an HTTP only persistent cookie. The cookie expiration is configured in the JWT configuration for the application or the global JWT configuration.

3. Authenticate a User with a one time password

This API is used to login using a One Time Password that has been returned from the Change Password API. The login request is nearly identical, however the oneTimePasswordId will take the place of both the loginId and the password properties.

3.1. Request

Authenticate a User

URI

POST /api/login

Table 6. Request Headers
X-Forwarded-For [String] Optional	The IP address of a client requesting authentication. If the IP address is provided it will be stored for login history of the user. It is generally preferred to specify the IP address in the request body. If it is not provided in the request body this header value will be used if available, the request body value will take precedence.

Table 7. Request Body
applicationId [UUID] Optional	The Id of the Application the user is to be logged into. If this parameter is omitted the user will still be authenticated but a login count will not be recorded for an Application.
ipAddress [String] Optional	The IP address of the end-user that is logging into FusionAuth. If this value is omitted FusionAuth will attempt to obtain the IP address of the client, the value will be that of the `X-Forwarded-For` header if provided or the last proxy that sent the request. The IP address will be stored in the User login history.
oneTimePassword [String] Required	The one time password returned by the Change Password API. This value takes the place of the loginId and the password fields.
metaData.device.description [String] Optional	A human readable description of the device used during login. This meta data is used to describe the refresh token that may be generated for this login request.
metaData.device.name [String] Optional	A human readable name of the device used during login. This meta data is used to describe the refresh token that may be generated for this login request.
metaData.device.type [String] Optional	The type of device used during login. The following types may be specified: `BROWSER` `DESKTOP` `LAPTOP` `MOBILE` `OTHER` `SERVER` `TABLET` `TV` `UNKNOWN` This meta data is used to describe the refresh token that may be generated for this login request.
noJWT [Boolean] Optional defaults to `false`	When this value is set to true a JWT will not be issued as part of this request. The response body will not contain the `token` or `refreshToken` fields, and the `access_token` and `refresh_token` cookies will not be written to the HTTP response. This optional parameter may be helpful when performing high volume authentication requests and the JWT is not being utilized, in this scenario removing the additional latency required to issue and sign the JWT may have a measurable cumulative effect on performance.
twoFactorTrustId [String] Optional	The Two Factor Trust identifier returned by the Two Factor Login API response. This value be may be provided to bypass the Two Factor challenge when a User has Two Factor enabled.

Example Request JSON

{
  "oneTimePassword": "YkQY5Gsyo4RlfmDciBGRmvfj3RmatUqrbjoIZ19fmw4",
  "applicationId": "10000000-0000-0002-0000-000000000001",
  "ipAddress": "192.168.1.42"
}

3.2. Response

The response for this API contains the User object.

Table 8. Response Codes
Code	Description
200	The authentication was successful. The response will contain the User object that was authenticated.
202	The user was authenticated successfully. The user is not registered for the application specified by `applicationId` on the request. The response will contain the User object that was authenticated.
203	The user was authenticated successfully. The user is required to change their password, the response will contain the `changePasswordId` to be used on the Change Password API. Example Response JSON `{ "changePasswordId": "XOgai4Ro68xfGiex0ngXiJ2bbhduM4Pm7h3lvF0xibQ" }`
212	The user’s email address has not yet been verified. The response will contain the User object that was authenticated.
242	The user was authenticated successfully. The user has two factor authentication enabled, the response will contain the `twoFactorId` to be used on the Complete Two Factor Authentication. Example Response JSON `{ "twoFactorId": "YkQY5Gsyo4RlfmDciBGRmvfj3RmatUqrbjoIZ19fmw4" }`
400	The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors.
401	You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication. By default, this API will require authentication when called with an `applicationId`. Authentication may be disabled per Application, see `application.loginConfiguration.requireAuthentication` in the Application API or the Security tab in the Application configuration. Prior to version `1.5.0` this API never require an API key.
404	The user was not found or the password was incorrect. The response will be empty.
409	The user is currently in an action that has prevented login. The response will contain the actions that prevented login. Example Response JSON `{ "actions": [ { "actionId": "00000000-0000-0000-0000-000000000042", "actionerUserId": "00000000-0000-0001-0000-000000000000", "expiry": 1571786483322, "localizedName": "Prevent Login Action", "localizedReason": "Hard Lock", "name": "Prevent Login Action", "reason": "Hard Lock", "reasonCode": "hard_lock" } ] }`
410	The user has expired. The response will be empty.
423	The user is locked and cannot login. The response will be empty. Prior to version 1.9.0 a 404 status code will be returned instead.
500	There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.
503	The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

Table 9. Response Body
refreshToken [String]	The refresh token that can be used to obtain a new access token once the provide one has expired.
state [Object]	If authenticated using a One Time Password and state was provided during the Change Password request this value will be returned exactly as it was provided.
token [String]	The access token, this string is an encoded JSON Web Token (JWT).
user.active [Boolean]	True if the User is active. False if the User has been deactivated. Deactivated Users will not be able to login.
user.birthDate [String]	The User’s birthdate formatted as `YYYY-MM-DD`
user.cleanSpeakId [UUID]	This Id is used by FusionAuth when the User’s username is sent to CleanSpeak to be moderated (filtered and potentially sent to the approval queue). It is the content Id of the username inside CleanSpeak.
user.data [Object]	An object that can hold any information about the User that should be persisted.
user.email [String]	The User’s email address.
user.expiry [Long]	The expiration instant of the User’s account. An expired user is not permitted to login.
user.firstName [String]	The first name of the User.
user.fullName [String]	The User’s full name as a separate field that is not calculated from firstName and lastName.
user.id [UUID]	The User’s unique Id.
user.imageUrl [String]	The URL that points to an image file that is the User’s profile image.
user.insertInstant [Long]	The instant when user was created.
user.lastLoginInstant [Long]	The instant when the User logged in last.
user.lastName [String]	The User’s last name.
user.middleName [String]	The User’s middle name.
user.mobilePhone [String]	The User’s mobile phone number. This is useful is you will be sending push notifications or SMS messages to the User.
user.passwordChangeRequired [Boolean]	Indicates that the User’s password needs to be changed during their next login attempt.
user.passwordLastUpdateInstant [Long]	The instant that the User last changed their password.
user.preferredLanguages [Array<String>]	An array of locale strings that give, in order, the User’s preferred languages. These are important for email templates and other localizable text. See Locales.
user.registrations [Array]	The list of registrations for the User.
user.registrations`[x]`.applicationId [UUID]	The Id of the Application that this registration is for.
user.registrations`[x]`.authenticationToken [String]	The Authentication Token for this registration (if one exists).
user.registrations`[x]`.cleanSpeakId [UUID]	This Id is used by FusionAuth when the User’s username for this registration is sent to CleanSpeak to be moderated (filtered and potentially sent to the approval queue). It is the content Id of the username inside CleanSpeak.
user.registrations`[x]`.data [Object]	An object that can hold any information about the User for this registration that should be persisted.
user.registrations`[x]`.id [UUID]	The Id of this registration.
user.registrations`[x]`.insertInstant [Long]	The instant that this registration was created.
user.registrations`[x]`.lastLoginInstant [Long]	The instant that the User last logged into the Application for this registration.
user.registrations`[x]`.preferredLanguages [Array<String>]	An array of locale strings that give, in order, the User’s preferred languages for this registration. These are important for email templates and other localizable text.
user.registrations`[x]`.roles [Array<String>]	The list of roles that the User has for this registration.
user.registrations`[x]`.timezone [String]	The User’s preferred timezone for this registration. The string will be in an IANA time zone format.
user.registrations`[x]`.tokens [Map<String,String>] Available Since 1.1.0	A map that contains tokens returned from identity providers. For example, if this user has authenticated using the Facebook Identity Provider, the Facebook access token will be available in this map, keyed by name `Facebook`. For an OpenID Connect Identity provider, or other generic providers, if a token is stored it will be keyed by the Identity Provider unique Id.
user.registrations`[x]`.username [String]	The username of the User for this registration only.
user.registrations`[x]`.usernameStatus [String]	The current status of the username. This is used if you are moderating usernames via CleanSpeak. The possible values are: `ACTIVE` - the username is active `PENDING` - the username is pending approval/moderation `REJECTED` - the username was rejected during moderation If a username has been rejected, it is still possible to allow the User to update it and have the new one moderated again.
user.registrations`[x]`.verified [Boolean]	This value indicates if this User’s registration has been verified.
user.timezone [String]	The User’s preferred timezone. This can be used as a default to display instants, and it is recommended that you allow User’s to change this per-session. The string will be in an IANA time zone format.
user.twoFactorDelivery [String]	The User’s preferred delivery for verification codes during a two factor login request. The possible values are: `None` `TextMessage`
user.twoFactorEnabled [Boolean]	Determines if the User has two factor authentication enabled for their account or not.
user.username [String]	The username of the User.
user.usernameStatus [String]	The current status of the username. This is used if you are moderating usernames via CleanSpeak. The possible values are: `ACTIVE` - the username is active `PENDING` - the username is pending approval/moderation `REJECTED` - the username was rejected during moderation If a username has been rejected, it is still possible to allow the User to update it and have the new one moderated again.
user.verified [Boolean]	Whether or not the User’s email has been verified.

Example Response JSON

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE0ODUxNDA5ODQsImlhdCI6MTQ4NTEzNzM4NCwiaXNzIjoiYWNtZS5jb20iLCJzdWIiOiIyOWFjMGMxOC0wYjRhLTQyY2YtODJmYy0wM2Q1NzAzMThhMWQiLCJhcHBsaWNhdGlvbklkIjoiNzkxMDM3MzQtOTdhYi00ZDFhLWFmMzctZTAwNmQwNWQyOTUyIiwicm9sZXMiOltdfQ.Mp0Pcwsz5VECK11Kf2ZZNF_SMKu5CgBeLN9ZOP04kZo",
  "user": {
    "active": true,
    "birthDate": "1976-05-30",
    "data": {
      "displayName": "Johnny Boy",
      "favoriteColors": [
        "Red",
        "Blue"
      ]
    },
    "email": "example@fusionauth.io",
    "expiry": 1571786483322,
    "firstName": "John",
    "fullName": "John Doe",
    "id": "00000000-0000-0001-0000-000000000000",
    "imageUrl": "http://65.media.tumblr.com/tumblr_l7dbl0MHbU1qz50x3o1_500.png",
    "lastLoginInstant": 1471786483322,
    "lastName": "Doe",
    "middleName": "William",
    "mobilePhone": "303-555-1234",
    "passwordChangeRequired": false,
    "passwordLastUpdateInstant": 1471786483322,
    "preferredLanguages": [
      "en",
      "fr"
    ],
    "registrations": [
      {
        "applicationId": "10000000-0000-0002-0000-000000000001",
        "data": {
          "displayName": "Johnny",
          "favoriteSports": [
            "Football",
            "Basketball"
          ]
        },
        "id": "00000000-0000-0002-0000-000000000000",
        "insertInstant": 1446064706250,
        "lastLoginInstant": 1456064601291,
        "preferredLanguages": [
          "en",
          "fr"
        ],
        "roles": [
          "user",
          "community_helper"
        ],
        "tokens": {
          "Facebook": "nQbbBIzDhMXXfa7iDUoonz5zS",
          "19544aa2-d634-4859-b193-e57af82b5d12": "eu1SsrjsiDf3h3LryUjxHIKTS0yyrbiPcsKF3HDp"
        },
        "username": "johnny123",
        "usernameStatus": "ACTIVE"
      }
    ],
    "timezone": "America/Denver",
    "twoFactorEnabled": false,
    "usernameStatus": "ACTIVE",
    "username": "johnny123",
    "verified": true
  }
}

Table 10. Response Cookies
access_token [String]	The encoded access token. This cookie is written in the response as an HTTP Only session cookie.
refresh_token [String]	The refresh token. This cookie is written in the response as an HTTP only persistent cookie. The cookie expiration is configured in the JWT configuration for the application or the global JWT configuration.

4. Complete Two Factor Authentication

The Two Factor Login API is used to complete the authentication process when a 242 is returned by the Login API.

4.1. Request

Complete a login request when a User has Two Factor authentication enabled.

Complete a Two Factor Login

URI

POST /api/two-factor/login

Table 11. Request Headers
X-Forwarded-For [String] Optional	The IP address of a client requesting authentication. If the IP address is provided it will be stored for login history of the user. It is generally preferred to specify the IP address in the request body. If it is not provided in the request body this header value will be used if available, the request body value will take precedence.

Table 12. Request Body
applicationId [UUID] Optional	The Id of the Application the user is to be logged into. If this parameter is omitted the user will still be authenticated but a login count will not be recorded for an Application.
code [String] Required	The time based one time use password, also called a Two Factor verification code.
device [String] Optional	The unique device identifier for this request. Use this parameter to cause a refresh token cookie will be written to the client on the response named `refresh_token` and it will also be provided in the response body. This value should be unique to the device and the same device id should be sent on subsequent requests for the same device. Removed in version 1.5.0 This parameter is no longer required to receive a Refresh Token, if it is provided on the request it will be ignored. In version 1.5.0 and later Refresh Tokens are issued by the Login API based upon the Application configuration. See `loginConfiguration` settings in the Application API.
ipAddress [String] Optional	The IP address of the end-user that is logging into FusionAuth. If this value is omitted FusionAuth will attempt to obtain the IP address of the client, the value will be that of the `X-Forwarded-For` header if provided or the last proxy that sent the request. The IP address will be stored in the User login history.
metaData.device.description [String] Optional	A human readable description of the device represented by the `device` parameter.
metaData.device.lastAccessedAddress [String] Optional	The IP address of this login request.
metaData.device.name [String] Optional	A human readable name of the device represented by the `device` parameter.
metaData.device.type [String] Optional	The type of device represented by the `device` parameter. The following types may be specified: `BROWSER` `DESKTOP` `LAPTOP` `MOBILE` `OTHER` `SERVER` `TABLET` `TV` `UNKNOWN`
noJWT [Boolean] Optional defaults to `false`	When this value is set to true a JWT will not be issued as part of this request. The response body will not contain the `token` field, and the `access_token` and `refresh_token` cookies will not be written to the HTTP response.
trustComputer [Boolean] Optional defaults to `false`	When this value is set to true the response will contain a Two Factor Trust identifier. This can be used on subsequent Login requests to allow the Two Factor challenge to be bypassed.
twoFactorId [String] Required	The two factor Id generated and returned in the response body during the initial authentication attempt. The default duration of this identifier is 5 minutes. This means that you have 5 minutes to complete the request to this API after calling the Login API. Once the identifier has expired you will need to call the Login API again to restart the process. This duration can be modified using the System Configuration API or in the FusionAuth UI.

Example Request JSON

{
  "applicationId": "10000000-0000-0002-0000-000000000001",
  "code": "915187",
  "ipAddress": "192.168.1.42",
  "twoFactorId": "YkQY5Gsyo4RlfmDciBGRmvfj3RmatUqrbjoIZ19fmw4"
}

4.2. Response

The response for this API contains the User object.

Table 13. Response Codes
Code	Description
200	The authentication was successful. The response will contain the User object that was authenticated.
202	The user was authenticated successfully. The user is not registered for the application specified by `applicationId` on the request. The response will contain the User object that was authenticated.
203	The user was authenticated successfully. The user is required to change their password, the response will contain the `changePasswordId` to be used on the Change Password API. Example Response JSON `{ "changePasswordId": "XOgai4Ro68xfGiex0ngXiJ2bbhduM4Pm7h3lvF0xibQ" }`
212	The user’s email address has not yet been verified. The response will contain the User object that was authenticated.
400	The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors.
404	The `twoFactorId` was invalid or expired. You will need to authenticate again using the Login API. The response will be empty.
409	The user is currently in an action that has prevented login. The response will contain the actions that prevented login. Example Response JSON `{ "actions": [ { "actionId": "00000000-0000-0000-0000-000000000042", "actionerUserId": "00000000-0000-0001-0000-000000000000", "expiry": 1571786483322, "localizedName": "Prevent Login Action", "localizedReason": "Hard Lock", "name": "Prevent Login Action", "reason": "Hard Lock", "reasonCode": "hard_lock" } ] }`
410	The user has expired. The response will be empty.
421	The `code` request parameter is not valid. The response will be empty.
500	There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.
503	The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

Table 14. Response Body
refreshToken [String]	The refresh token that can be used to obtain a new access token once the provide one has expired.
state [Object]	If authenticated using a One Time Password and state was provided during the Change Password request this value will be returned exactly as it was provided.
token [String]	The access token, this string is an encoded JSON Web Token (JWT).
twoFactorTrustId [String]	The Two Factor Trust identifier. This value is returned when `trustComputer` was set to `true` on the request. This value can be used by subsequent login requests to bypass the Two Factor challenge.
user.active [Boolean]	True if the User is active. False if the User has been deactivated. Deactivated Users will not be able to login.
user.birthDate [String]	The User’s birthdate formatted as `YYYY-MM-DD`
user.cleanSpeakId [UUID]	This Id is used by FusionAuth when the User’s username is sent to CleanSpeak to be moderated (filtered and potentially sent to the approval queue). It is the content Id of the username inside CleanSpeak.
user.data [Object]	An object that can hold any information about the User that should be persisted.
user.email [String]	The User’s email address.
user.expiry [Long]	The expiration instant of the User’s account. An expired user is not permitted to login.
user.firstName [String]	The first name of the User.
user.fullName [String]	The User’s full name as a separate field that is not calculated from firstName and lastName.
user.id [UUID]	The User’s unique Id.
user.imageUrl [String]	The URL that points to an image file that is the User’s profile image.
user.insertInstant [Long]	The instant when user was created.
user.lastLoginInstant [Long]	The instant when the User logged in last.
user.lastName [String]	The User’s last name.
user.middleName [String]	The User’s middle name.
user.mobilePhone [String]	The User’s mobile phone number. This is useful is you will be sending push notifications or SMS messages to the User.
user.passwordChangeRequired [Boolean]	Indicates that the User’s password needs to be changed during their next login attempt.
user.passwordLastUpdateInstant [Long]	The instant that the User last changed their password.
user.preferredLanguages [Array<String>]	An array of locale strings that give, in order, the User’s preferred languages. These are important for email templates and other localizable text. See Locales.
user.registrations [Array]	The list of registrations for the User.
user.registrations`[x]`.applicationId [UUID]	The Id of the Application that this registration is for.
user.registrations`[x]`.authenticationToken [String]	The Authentication Token for this registration (if one exists).
user.registrations`[x]`.cleanSpeakId [UUID]	This Id is used by FusionAuth when the User’s username for this registration is sent to CleanSpeak to be moderated (filtered and potentially sent to the approval queue). It is the content Id of the username inside CleanSpeak.
user.registrations`[x]`.data [Object]	An object that can hold any information about the User for this registration that should be persisted.
user.registrations`[x]`.id [UUID]	The Id of this registration.
user.registrations`[x]`.insertInstant [Long]	The instant that this registration was created.
user.registrations`[x]`.lastLoginInstant [Long]	The instant that the User last logged into the Application for this registration.
user.registrations`[x]`.preferredLanguages [Array<String>]	An array of locale strings that give, in order, the User’s preferred languages for this registration. These are important for email templates and other localizable text.
user.registrations`[x]`.roles [Array<String>]	The list of roles that the User has for this registration.
user.registrations`[x]`.timezone [String]	The User’s preferred timezone for this registration. The string will be in an IANA time zone format.
user.registrations`[x]`.tokens [Map<String,String>] Available Since 1.1.0	A map that contains tokens returned from identity providers. For example, if this user has authenticated using the Facebook Identity Provider, the Facebook access token will be available in this map, keyed by name `Facebook`. For an OpenID Connect Identity provider, or other generic providers, if a token is stored it will be keyed by the Identity Provider unique Id.
user.registrations`[x]`.username [String]	The username of the User for this registration only.
user.registrations`[x]`.usernameStatus [String]	The current status of the username. This is used if you are moderating usernames via CleanSpeak. The possible values are: `ACTIVE` - the username is active `PENDING` - the username is pending approval/moderation `REJECTED` - the username was rejected during moderation If a username has been rejected, it is still possible to allow the User to update it and have the new one moderated again.
user.registrations`[x]`.verified [Boolean]	This value indicates if this User’s registration has been verified.
user.timezone [String]	The User’s preferred timezone. This can be used as a default to display instants, and it is recommended that you allow User’s to change this per-session. The string will be in an IANA time zone format.
user.twoFactorDelivery [String]	The User’s preferred delivery for verification codes during a two factor login request. The possible values are: `None` `TextMessage`
user.twoFactorEnabled [Boolean]	Determines if the User has two factor authentication enabled for their account or not.
user.username [String]	The username of the User.
user.usernameStatus [String]	The current status of the username. This is used if you are moderating usernames via CleanSpeak. The possible values are: `ACTIVE` - the username is active `PENDING` - the username is pending approval/moderation `REJECTED` - the username was rejected during moderation If a username has been rejected, it is still possible to allow the User to update it and have the new one moderated again.
user.verified [Boolean]	Whether or not the User’s email has been verified.

Example Response JSON

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE0ODUxNDA5ODQsImlhdCI6MTQ4NTEzNzM4NCwiaXNzIjoiYWNtZS5jb20iLCJzdWIiOiIyOWFjMGMxOC0wYjRhLTQyY2YtODJmYy0wM2Q1NzAzMThhMWQiLCJhcHBsaWNhdGlvbklkIjoiNzkxMDM3MzQtOTdhYi00ZDFhLWFmMzctZTAwNmQwNWQyOTUyIiwicm9sZXMiOltdfQ.Mp0Pcwsz5VECK11Kf2ZZNF_SMKu5CgBeLN9ZOP04kZo",
  "user": {
    "active": true,
    "birthDate": "1976-05-30",
    "data": {
      "displayName": "Johnny Boy",
      "favoriteColors": [
        "Red",
        "Blue"
      ]
    },
    "email": "example@fusionauth.io",
    "expiry": 1571786483322,
    "firstName": "John",
    "fullName": "John Doe",
    "id": "00000000-0000-0001-0000-000000000000",
    "imageUrl": "http://65.media.tumblr.com/tumblr_l7dbl0MHbU1qz50x3o1_500.png",
    "lastLoginInstant": 1471786483322,
    "lastName": "Doe",
    "middleName": "William",
    "mobilePhone": "303-555-1234",
    "passwordChangeRequired": false,
    "passwordLastUpdateInstant": 1471786483322,
    "preferredLanguages": [
      "en",
      "fr"
    ],
    "registrations": [
      {
        "applicationId": "10000000-0000-0002-0000-000000000001",
        "data": {
          "displayName": "Johnny",
          "favoriteSports": [
            "Football",
            "Basketball"
          ]
        },
        "id": "00000000-0000-0002-0000-000000000000",
        "insertInstant": 1446064706250,
        "lastLoginInstant": 1456064601291,
        "preferredLanguages": [
          "en",
          "fr"
        ],
        "roles": [
          "user",
          "community_helper"
        ],
        "tokens": {
          "Facebook": "nQbbBIzDhMXXfa7iDUoonz5zS",
          "19544aa2-d634-4859-b193-e57af82b5d12": "eu1SsrjsiDf3h3LryUjxHIKTS0yyrbiPcsKF3HDp"
        },
        "username": "johnny123",
        "usernameStatus": "ACTIVE"
      }
    ],
    "timezone": "America/Denver",
    "twoFactorEnabled": false,
    "usernameStatus": "ACTIVE",
    "username": "johnny123",
    "verified": true
  }
}

Table 15. Response Cookies
access_token [String]	The encoded access token. This cookie is written in the response as an HTTP Only session cookie.
refresh_token [String]	The refresh token. This cookie is written in the response as an HTTP Only persistent cookie. The cookie expiration is configured in the JWT configuration for the application or the global JWT configuration.
fusionauth.trust [String]	The Two Factor Trust identifier. This value is returned when `trustComputer` was set to `true` on the request. This value can be used by subsequent login requests to bypass the Two Factor challenge. This cookie is written in the response as an HTTP Only persistent cookie.

Sends a ping to FusionAuth indicating that the user was automatically logged into an application. When using FusionAuth’s SSO or your own, you should call this if the user is already logged in centrally, but accesses an application where they no longer have a session. This helps correctly track login counts, times and helps with reporting.

5.1. Request

Update the login instant for a given User and Application

URI

PUT /api/login/{userId}/{applicationId}?ipAddress={ipAddress}

Table 16. Request Headers
X-Forwarded-For [String] Optional	The IP address of a client requesting authentication. If the IP address is provided it will be stored for login history of the user. It is generally preferred to specify the IP address in the request body. If it is not provided in the request body this header value will be used if available, the request body value will take precedence.

Table 17. Request Parameters
userId [UUID] Required	The Id of the user logging in.
applicationId [UUID] Required	The Id of the Application the user is logging into.
ipAddress [String] Optional	The IP address of the end-user that is logging into FusionAuth. If this value is omitted FusionAuth will attempt to obtain the IP address of the client, the value will be that of the `X-Forwarded-For` header if provided or the last proxy that sent the request. The IP address will be stored in the User login history.

Update the login instant for a given User and Application using a JWT

URI

PUT /api/login?ipAddress={ipAddress}

The userId and applicationId are not required on the request, these values will be retrieved from the identity claims in the JWT payload.

Table 18. Request Parameters
ipAddress [String] Optional	The IP address of the end-user that is logging into FusionAuth. If this value is omitted FusionAuth will attempt to obtain the IP address of the client, the value will be that of the `X-Forwarded-For` header if provided or the last proxy that sent the request. The IP address will be stored in the User login history.

5.2. Response

This API does not return a JSON response body.

Table 19. Response Codes
Code	Description
200	The update was successful.
202	The user exists but is not registered for the application specified by applicationId on the request.
400	The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors.
401	You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
404	The user was not found.
500	There was an internal error. A stack trace is provided and logged in the FusionAuth log files.
503	The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

6. Logout a User

The Logout API is intended to be used to remove the refresh token and access token cookies if they exist on the client and revoke the refresh token. This API does nothing if the request does not contain an access token or refresh token cookies.

The refresh token is only revoked if the request contains the refresh_token cookie or the refreshToken request parameter.

6.1. Request

Remove the access_token and refresh_token cookies if they exist on the client.

URI

POST /api/logout?global={global}&refreshToken={refreshToken}

Table 20. Request Cookies
access_token [String] Optional	The access token cookie. When this cookie available in the request it will be deleted from the client.
refresh_token [String] Optional	The refresh token cookie. When this cookie available in the request it will be deleted from the client and revoked in FusionAuth.

Table 21. Request Parameters
global [Boolean] Optional defaults to `false`	When this value is set to true all of the refresh tokens issued to the owner of the provided refresh token will be revoked. If no refresh token is provided on the request no refresh tokens will be revoked.
refreshToken [String] Optional	The `refresh_token` as a request parameter instead of coming in via a cookie. If provided this takes precedence over the cookie.

6.2. Response

This API does not return a JSON response body.

Table 22. Response Codes
Code	Description
200	The update was successful.
500	There was an internal error. A stack trace is provided and logged in the FusionAuth log files.

Available Since Version 1.7.0

This API allows you to search and paginate through the Login Records.

7.1. Request

Searches for Login Records given search criteria

URI

GET /api/system/login-record/search?applicationId={applicationId}&start={start}&end={end}&userId={userId}

When calling the API using a GET request you will send the search criteria on the URL using request parameters. In order to simplify the example URL above, not every possible parameter is shown, however using the provided pattern you may add any of the documented request parameters to the URL.

Table 23. Request Parameters
applicationId [UUID] Optional	The unique Id of the Application used to narrow the search results to logins for a particular application.
end [Long] Optional	The end instant of the date/time range to search within.
numberOfResults [Integer] Optional defaults to `25`	The number of results to return from the search.
retrieveTotal [Boolean] Optional defaults to `false`	Set this to `true` if you want the total possible results returned in the response. With a very large number of login records settings this value to `true` will increase the response time of this request.
start [Long] Optional	The start instant of the date/time range to search within.
startRow [Integer] Optional defaults to `0`	The offset into the total results. In order to paginate the results, increment this value by the numberOfResults for subsequent requests.
userId [String] Optional	The unique Id of the User used to narrow the search results to login records for a particular user.

Searches for Login Records given search criteria

URI

POST /api/system/login-record/search

When calling the API using a POST request you will send the search criteria in a JSON request body.

Table 24. Request Body
retrieveTotal [Boolean] Optional defaults to `false`	Set this to `true` if you want the total possible results returned in the response. With a very large number of login records settings this value to `true` will increase the response time of this request.
search.applicationId [UUID] Optional	The unique Id of the Application used to narrow the search results to logins for a particular application.
search.end [Long] Optional	The end instant of the date/time range to search within.
search.numberOfResults [Integer] Optional defaults to `25`	The number of results to return from the search.
search.start [Long] Optional	The start instant of the date/time range to search within.
search.startRow [Integer] Optional defaults to `0`	The offset into the total results. In order to paginate the results, increment this value by the numberOfResults for subsequent requests.
search.userId [UUID] Optional	The unique Id of the User used to narrow the search results to login records for a particular user.

7.2. Response

The response for this API will contain all login records matching the search criteria in paginated format.

Table 25. Response Codes
Code	Description
200	The request was successful. The response will contain a JSON body.
400	The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors.
401	You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
404	The object you requested doesn’t exist. The response will be empty.
500	There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.
503	The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

Table 26. Response Body
logins [Array]	The list of Login Records returned by the search.
logins`[x]`.applicationId [UUID]	The unique Id of the application.
logins`[x]`.applicationName [String]	The name of the application. Because the application name may be modified after the login event occurred, only the applicationId should be considered immutable for historical purposes when identifying the application.
logins`[x]`.loginId [String]	The email or username of the user. Because email or username may be modified after the login event occurred, only the userId and the should be considered immutable for historical purposes when identifying the user.
logins`[x]`.instant [Long]	The instant when the login occurred.
logins`[x]`.ipAddress [String]	The recorded IP address for this login record.
logins`[x]`.userId [UUID]	The unique Id of the user.
total [Long]	The total number of login records available. This will only be provided in the response when retrieveTotal was set to `true` on the request.

Example JSON Response

{
  "logins": [
    {
      "applicationId": "2edd54c6-695d-409e-b8af-2d3ebf73711a",
      "applicationName": "Pied Piper Admin Portal",
      "loginId": "richard@piedpiper.com",
      "instant": 1562608320303,
      "ipAddress": "42.42.42.42",
      "userId": "d7be5e1e-0020-4f6f-a9dc-0f9230650042"
    },
    {
      "applicationId": "3c219e58-ed0e-4b18-ad48-f4f92793ae32",
      "applicationName": "FusionAuth",
      "loginId": "monica@piedpiper.com",
      "instant": 1562608320901,
      "ipAddress": "192.168.1.1",
      "userId": "af8fb4d8-df6b-41c6-9843-813da943b005"
    },
    {
      "applicationId": "2edd54c6-695d-409e-b8af-2d3ebf73711a",
      "applicationName": "Pied Piper Admin Portal",
      "loginId": "richard@piedpiper.com",
      "instant": 1562608399639,
      "ipAddress": "42.42.42.42",
      "userId": "d7be5e1e-0020-4f6f-a9dc-0f9230650042"
    }
  ],
  "total": 3
}

Available Since Version 1.7.0

This API is used to export Login Records, the response will be a compressed zip archive.

8.1. Request

Export the Login Records matching the criteria

URI

GET /api/system/login-record/export?applicationId={applicationId}&start={start}&end={end}&userId={userId}

When calling the API using a GET request you will send the export criteria on the URL using request parameters. In order to simplify the example URL above, not every possible parameter is shown, however using the provided pattern you may add any of the documented request parameters to the URL.

Table 27. Request Parameters
applicationId [UUID] Optional	The unique Id of the Application used to reduce the export result to logins for a particular application.
dateTimeSecondsFormat [String] Optional defaults to [see description]	The format string used to format the date and time columns in the export result. When this parameter is omitted a default format of `M/d/yyyy hh:mm:ss a z` will be used. See the DateTimeFormatter patterns for additional examples.
end [Long] Optional	The end instant of the date/time range to search within.
start [Long] Optional	The start instant of the date/time range to search within.
userId [UUID] Optional	The unique Id of the User used to reduce the export result to logins for a particular user.
zoneId [String] Optional defaults to [see description].	The time zone used to adjust the stored UTC time in the export result. For example: `America/Denver` or `US/Mountain` When this parameter is omitted the configured default report time zone will be used. See reportTimezone in the System Configuration API.

Export the Login Records matching the criteria

URI

POST /api/system/login-record/export

When calling the API using a POST request you will send the export criteria in a JSON request body.

Table 28. Request Body
criteria.applicationId [UUID] Optional	The unique Id of the Application used to reduce the export result to logins for a particular application.
criteria.end [Long] Optional	The end instant of the date/time range to include in the export.
criteria.start [Long] Optional	The start instant of the date/time range to include in the export.
criteria.userId [UUID] Optional	The unique Id of the User used to reduce the export result to logins for a particular user.
dateTimeSecondsFormat [String] Optional defaults to [see description]	The format string used to format the date and time columns in the export result. When this parameter is omitted a default format of `M/d/yyyy hh:mm:ss a z` will be used. See the DateTimeFormatter patterns for additional examples.
zoneId [String] Optional defaults to [see description]	The time zone used to adjust the stored UTC time in the export result. For example: `America/Denver` or `US/Mountain` When this parameter is omitted the configured default report time zone will be used. See reportTimezone in the System Configuration API.

8.2. Response

The response for this API will contain a compressed zip of the audit logs.

Table 29. Response Codes
Code	Description
200	The request was successful. The response will be a compressed archive byte stream with a `Content-Type` of `application/zip`.
400	The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors.
401	You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
404	The object you requested doesn’t exist. The response will be empty.
500	There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.
503	The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

1. Overview

2. Authenticate a User

2.1. Request

2.2. Response

3. Authenticate a User with a one time password

3.1. Request

3.2. Response

4. Complete Two Factor Authentication

4.1. Request

4.2. Response

5. Update Login Instant

5.1. Request

5.2. Response

6. Logout a User

6.1. Request

6.2. Response

7. Search Login Records

7.1. Request

7.2. Response

8. Export Login Records

8.1. Request

8.2. Response