Login APIs - Home - FusionAuth

1. Overview

This page contains the APIs that are used to authenticate and track user logins.

[authenticate-a-user]
[complete-two-factor-authentication]
[update-login-instant]
[logout-a-user]

2. Authenticate a User

The Login API is used authenticate a user in FusionAuth.

2.1. Request

Authenticate a User.

URI

POST /api/login

Table 1. Request Headers
X-Forwarded-For [String] Optional	The IP address of a client requesting authentication. If the IP address is provided it will be stored for login history of the user. It is generally preferred to specify the IP address in the request body. If it is not provided in the request body this header value will be used if available, the request body value will take precedence.

Table 2. Request Body
applicationId [UUID] Optional	The Id of the Application the user is to be logged into. If this parameter is omitted the user will still be authenticated but a login count will not be recorded for an Application.
device [String] Optional Deprecated	The unique device identifier for this request. This value should be unique to the device and the same device Id should be sent on subsequent requests for the same device. Using this parameter will indicate you wish to receive a refresh token on the response. The refresh token will be written on the HTTP response as an HTTP only persistent cookie named `refresh_token`, and also be provided in the JSON response body. Removed in version 1.5.0 This parameter is no longer required to receive a Refresh Token, if it is provided on the request it will be ignored. In version 1.5.0 and later Refresh Tokens are issued by the Login API based upon the Application configuration. See `loginConfiguration` settings in the Application API.
ipAddress [String] Optional	The IP address of the end-user that is logging into FusionAuth. If this value is omitted FusionAuth will attempt to obtain the IP address of the client, the value will be that of the `X-Forwarded-For` header if provided or the last proxy that sent the request. The IP address will be stored in the User login history.
loginId [String] Required	The login identifier of the user. The login identifier can be either the `email` or the `username`.
metaData.device.description [String] Optional	A human readable description of the device used during login. This meta data is used to describe the refresh token that may be generated for this login request.
metaData.device.name [String] Optional	A human readable name of the device used during login. This meta data is used to describe the refresh token that may be generated for this login request.
metaData.device.type [String] Optional	The type of device used during login. The following types may be specified: `BROWSER` `DESKTOP` `LAPTOP` `MOBILE` `OTHER` `SERVER` `TABLET` `TV` `UNKNOWN` This meta data is used to describe the refresh token that may be generated for this login request.
noJWT [Boolean] Optional defaults to `false`	When this value is set to true a JWT will not be issued as part of this request. The response body will not contain the `token` or `refreshToken` fields, and the `access_token` and `refresh_token` cookies will not be written to the HTTP response. This optional parameter may be helpful when performing high volume authentication requests and the JWT is not being utilized, in this scenario removing the additional latency required to issue and sign the JWT may have a measurable cumulative effect on performance.
password [String] Required	The user’s password or an Application specific Authentication Token.
twoFactorTrustId [String] Optional	The Two Factor Trust identifier returned by the Two Factor Login API response. This value be may be provided to bypass the Two Factor challenge when a User has Two Factor enabled.

Example Request JSON

{
  "loginId": "example@fusionauth.io",
  "password": "password",
  "applicationId": "10000000-0000-0002-0000-000000000001",
  "ipAddress": "192.168.1.42"
}

2.2. Response

The response for this API contains the User object.

Table 3. Response Codes
Code	Description
200	The authentication was successful. The response will contain the User object that was authenticated.
202	The user was authenticated successfully. The user is not registered for the application specified by `applicationId` on the request. The response will contain the User object that was authenticated.
203	The user was authenticated successfully. The user is required to change their password, the response will contain the `changePasswordId` to be used on the link::users#change-a-user-s-password[Change Password] API. Example Response JSON `{ "changePasswordId": "XOgai4Ro68xfGiex0ngXiJ2bbhduM4Pm7h3lvF0xibQ" }`
212	The user’s email address has not yet been verified. The response will contain the User object that was authenticated.
242	The user was authenticated successfully. The user has two factor authentication enabled, the response will contain the `twoFactorId` to be used on the [complete-two-factor-authentication]. Example Response JSON `{ "twoFactorId": "YkQY5Gsyo4RlfmDciBGRmvfj3RmatUqrbjoIZ19fmw4" }`
400	The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors.
404	The user was not found or the password was incorrect. The response will be empty.
409	The user is currently in an action that has prevented login. The response will contain the actions that prevented login. Example Response JSON `{ "actions": [ { "actionId": "00000000-0000-0000-0000-000000000042", "actionerUserId": "00000000-0000-0001-0000-000000000000", "expiry": 1571786483322, "localizedName": "Prevent Login Action", "localizedReason": "Hard Lock", "name": "Prevent Login Action", "reason": "Hard Lock", "reasonCode": "hard_lock" } ] }`
410	The user has expired. The response will be empty.
500	There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.
503	The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

Table 4. Response Body
refreshToken [String]	The refresh token that can be used to obtain a new access token once the provide one has expired. This value will only be included in the response body when the login request contains the `device` parameter. See the request parameter named `device` for more information.
token [String]	The access token, this string is an encoded JSON Web Token (JWT).
user.active [Boolean]	True if the User is active. False if the User has been deactivated. Deactivated Users will not be able to login.
user.birthDate [String]	The User’s birthdate formatted as `YYYY-MM-DD`
user.cleanSpeakId [UUID]	This Id is used by FusionAuth when the User’s username is sent to CleanSpeak to be moderated (filtered and potentially sent to the approval queue). It is the content Id of the username inside CleanSpeak.
user.data [Object]	An object that can hold any information about the User that should be persisted.
user.email [String]	The User’s email address.
user.expiry [Long]	The expiration instant of the User’s account. An expired user is not permitted to login.
user.firstName [String]	The first name of the User.
user.fullName [String]	The User’s full name (as a separate field that is not calculated from firstName and lastName)
user.id [UUID]	The User’s unique Id.
user.imageUrl [String]	The URL that points to an image file that is the User’s profile image.
user.insertInstant [Long]	The instant when user was created.
user.lastLoginInstant [Long]	The instant when the User logged in last.
user.lastName [String]	The User’s last name.
user.middleName [String]	The User’s middle name.
user.mobilePhone [String]	The User’s mobile phone number. This is useful is you will be sending push notifications or SMS messages to the User.
user.passwordChangeRequired [Boolean]	Indicates that the User’s password needs to be changed during their next login attempt.
user.passwordLastUpdateInstant [Long]	The instant that the User last changed their password.
user.preferredLanguages [Array<String>]	An array of locale strings that give, in order, the User’s preferred languages. These are important for email templates and other localizable text. See Locales.
user.registrations [Array]	The list of registrations for the User.
user.registrations`[x]`.applicationId [UUID]	The Id of the Application that this registration is for.
user.registrations`[x]`.authenticationToken [String]	The Authentication Token for this registration (if one exists).
user.registrations`[x]`.cleanSpeakId [UUID]	This Id is used by FusionAuth when the User’s username for this registration is sent to CleanSpeak to be moderated (filtered and potentially sent to the approval queue). It is the content Id of the username inside CleanSpeak.
user.registrations`[x]`.data [Object]	An object that can hold any information about the User for this registration that should be persisted.
user.registrations`[x]`.id [UUID]	The Id of this registration.
user.registrations`[x]`.insertInstant [Long]	The instant that this registration was created.
user.registrations`[x]`.lastLoginInstant [Long]	The instant that the User last logged into the Application for this registration.
user.registrations`[x]`.preferredLanguages [Array<String>]	An array of locale strings that give, in order, the User’s preferred languages for this registration. These are important for email templates and other localizable text.
user.registrations`[x]`.roles [Array<String>]	The list of roles that the User has for this registration.
user.registrations`[x]`.timezone [String]	The User’s preferred timezone for this registration.
user.registrations`[x]`.tokens [Map<String,String>] Available Since 1.1.0	A map that contains tokens returned from identity providers. For example, if this user has authenticated using the Facebook Identity Provider, the Facebook access token will be available in this map, keyed by name `Facebook`. For an OpenID Connect Identity provider, or other generic providers, if a token is stored it will be keyed by the Identity Provider unique Id.
user.registrations`[x]`.username [String]	The username of the User for this registration only.
user.registrations`[x]`.usernameStatus [String]	The current status of the username. This is used if you are moderating usernames via CleanSpeak. The possible values are: `ACTIVE` - the username is active `PENDING` - the username is pending approval/moderation `REJECTED` - the username was rejected during moderation If a username has been rejected, it is still possible to allow the User to update it and have the new one moderated again.
user.registrations`[x]`.verified [Boolean]	This value indicates if this User’s registration has been verified.
user.timezone [String]	The User’s preferred timezone. This can be used as a default to display instants. It is recommended that you allow User’s to change this per-session.
user.twoFactorDelivery [String]	The User’s preferred delivery for verification codes during a two factor login request. The possible values are: `None` `TextMessage`
user.twoFactorEnabled [Boolean]	Determines if the User has two factor authentication enabled for their account or not.
user.username [String]	The username of the User.
user.usernameStatus [String]	The current status of the username. This is used if you are moderating usernames via CleanSpeak. The possible values are: `ACTIVE` - the username is active `PENDING` - the username is pending approval/moderation `REJECTED` - the username was rejected during moderation If a username has been rejected, it is still possible to allow the User to update it and have the new one moderated again.
user.verified [Boolean]	Whether or not the User’s email has been verified.

Example Response JSON

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE0ODUxNDA5ODQsImlhdCI6MTQ4NTEzNzM4NCwiaXNzIjoiYWNtZS5jb20iLCJzdWIiOiIyOWFjMGMxOC0wYjRhLTQyY2YtODJmYy0wM2Q1NzAzMThhMWQiLCJhcHBsaWNhdGlvbklkIjoiNzkxMDM3MzQtOTdhYi00ZDFhLWFmMzctZTAwNmQwNWQyOTUyIiwicm9sZXMiOltdfQ.Mp0Pcwsz5VECK11Kf2ZZNF_SMKu5CgBeLN9ZOP04kZo",
  "user": {
    "active": true,
    "birthDate": "1976-05-30",
    "data": {
      "displayName": "Johnny Boy",
      "favoriteColors": [
        "Red",
        "Blue"
      ]
    },
    "email": "example@fusionauth.io",
    "expiry": 1571786483322,
    "firstName": "John",
    "fullName": "John Doe",
    "id": "00000000-0000-0001-0000-000000000000",
    "imageUrl": "http://65.media.tumblr.com/tumblr_l7dbl0MHbU1qz50x3o1_500.png",
    "lastLoginInstant": 1471786483322,
    "lastName": "Doe",
    "middleName": "William",
    "mobilePhone": "303-555-1234",
    "passwordChangeRequired": false,
    "passwordLastUpdateInstant": 1471786483322,
    "preferredLanguages": [
      "en",
      "fr"
    ],
    "registrations": [
      {
        "applicationId": "10000000-0000-0002-0000-000000000001",
        "data": {
          "displayName": "Johnny",
          "favoriteSports": [
            "Football",
            "Basketball"
          ]
        },
        "id": "00000000-0000-0002-0000-000000000000",
        "insertInstant": 1446064706250,
        "lastLoginInstant": 1456064601291,
        "preferredLanguages": [
          "en",
          "fr"
        ],
        "roles": [
          "user",
          "community_helper"
        ],
        "tokens": {
          "Facebook": "nQbbBIzDhMXXfa7iDUoonz5zS",
          "19544aa2-d634-4859-b193-e57af82b5d12": "eu1SsrjsiDf3h3LryUjxHIKTS0yyrbiPcsKF3HDp"
        },
        "username": "johnny123",
        "usernameStatus": "ACTIVE"
      }
    ],
    "timezone": "America/Denver",
    "twoFactorEnabled": false,
    "usernameStatus": "ACTIVE",
    "username": "johnny123",
    "verified": true
  }
}

Table 5. Response Cookies
access_token [String]	The encoded access token. This cookie is written in the response as an HTTP Only session cookie.
refresh_token [String]	The refresh token. This cookie is written in the response as an HTTP only persistent cookie. The cookie expiration is configured in the JWT configuration for the application or the global JWT configuration.

3. Complete Two Factor Authentication

The Two Factor Login API is used to complete the authentication process when a 242 is returned by the Login API.

3.1. Request

Complete a login request when a User has Two Factor authentication enabled.

Complete a Two Factor Login

URI

POST /api/two-factor/login

Table 6. Request Headers
X-Forwarded-For [String] Optional	The IP address of a client requesting authentication. If the IP address is provided it will be stored for login history of the user. It is generally preferred to specify the IP address in the request body. If it is not provided in the request body this header value will be used if available, the request body value will take precedence.

Table 7. Request Body
applicationId [UUID] Optional	The Id of the Application the user is to be logged into. If this parameter is omitted the user will still be authenticated but a login count will not be recorded for an Application.
code [String] Required	The time based one time use password, also called a Two Factor verification code.
device [String] Optional	The unique device identifier for this request. Use this parameter to cause a refresh token cookie will be written to the client on the response named `refresh_token` and it will also be provided in the response body. This value should be unique to the device and the same device id should be sent on subsequent requests for the same device.
ipAddress [String] Optional	The IP address of the end-user that is logging into FusionAuth. If this value is omitted FusionAuth will attempt to obtain the IP address of the client, the value will be that of the `X-Forwarded-For` header if provided or the last proxy that sent the request. The IP address will be stored in the User login history.
metaData.device.description [String] Optional	A human readable description of the device represented by the `device` parameter.
metaData.device.lastAccessedAddress [String] Optional	The IP address of this login request.
metaData.device.name [String] Optional	A human readable name of the device represented by the `device` parameter.
metaData.device.type [String] Optional	The type of device represented by the `device` parameter. The following types may be specified: `BROWSER` `DESKTOP` `LAPTOP` `MOBILE` `OTHER` `SERVER` `TABLET` `TV` `UNKNOWN`
noJWT [Boolean] Optional defaults to `false`	When this value is set to true a JWT will not be issued as part of this request. The response body will not contain the `token` field, and the `access_token` and `refresh_token` cookies will not be written to the HTTP response.
trustComputer [Boolean] Optional defaults to `false`	When this value is set to true the response will contain a Two Factor Trust identifier. This can be used on subsequent Login requests to allow the Two Factor challenge to be bypassed.
twoFactorId [String] Required	The two factor Id generated and returned in the response body during the initial authentication attempt. The default duration of this identifier is 5 minutes. This means that you have 5 minutes to complete the request to this API after calling the Login API. Once the identifier has expired you will need to call the Login API again to restart the process. This duration can be modified using the System Configuration API or in the FusionAuth UI.

Example Request JSON

{
  "applicationId": "10000000-0000-0002-0000-000000000001",
  "code": "915187",
  "ipAddress": "192.168.1.42",
  "twoFactorId": "YkQY5Gsyo4RlfmDciBGRmvfj3RmatUqrbjoIZ19fmw4"
}

3.2. Response

The response for this API contains the User object.

Table 8. Response Codes
Code	Description
200	The authentication was successful. The response will contain the User object that was authenticated.
202	The user was authenticated successfully. The user is not registered for the application specified by `applicationId` on the request. The response will contain the User object that was authenticated.
203	The user was authenticated successfully. The user is required to change their password, the response will contain the `changePasswordId` to be used on the Change Password API. Example Response JSON `{ "changePasswordId": "XOgai4Ro68xfGiex0ngXiJ2bbhduM4Pm7h3lvF0xibQ" }`
212	The user’s email address has not yet been verified. The response will contain the User object that was authenticated.
400	The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors.
404	The `twoFactorId` was invalid or expired. You will need to authenticate again using the Login API. The response will be empty.
409	The user is currently in an action that has prevented login. The response will contain the actions that prevented login. Example Response JSON `{ "actions": [ { "actionId": "00000000-0000-0000-0000-000000000042", "actionerUserId": "00000000-0000-0001-0000-000000000000", "expiry": 1571786483322, "localizedName": "Prevent Login Action", "localizedReason": "Hard Lock", "name": "Prevent Login Action", "reason": "Hard Lock", "reasonCode": "hard_lock" } ] }`
410	The user has expired. The response will be empty.
421	The `code` request parameter is not valid. The response will be empty.
500	There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.
503	The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

Table 9. Response Body
refreshToken [String]	The refresh token that can be used to obtain a new access token once the provide one has expired. This value will only be included in the response body when the login request contains the `device` parameter. See the request parameter named `device` for more information.
token [String]	The access token, this string is an encoded JSON Web Token (JWT).
twoFactorTrustId [String]	The Two Factor Trust identifier. This value is returned when `trustComputer` was set to `true` on the request. This value can be used by subsequent login requests to bypass the Two Factor challenge.
user.active [Boolean]	True if the User is active. False if the User has been deactivated. Deactivated Users will not be able to login.
user.birthDate [String]	The User’s birthdate formatted as `YYYY-MM-DD`
user.cleanSpeakId [UUID]	This Id is used by FusionAuth when the User’s username is sent to CleanSpeak to be moderated (filtered and potentially sent to the approval queue). It is the content Id of the username inside CleanSpeak.
user.data [Object]	An object that can hold any information about the User that should be persisted.
user.email [String]	The User’s email address.
user.expiry [Long]	The expiration instant of the User’s account. An expired user is not permitted to login.
user.firstName [String]	The first name of the User.
user.fullName [String]	The User’s full name (as a separate field that is not calculated from firstName and lastName)
user.id [UUID]	The User’s unique Id.
user.imageUrl [String]	The URL that points to an image file that is the User’s profile image.
user.insertInstant [Long]	The instant when user was created.
user.lastLoginInstant [Long]	The instant when the User logged in last.
user.lastName [String]	The User’s last name.
user.middleName [String]	The User’s middle name.
user.mobilePhone [String]	The User’s mobile phone number. This is useful is you will be sending push notifications or SMS messages to the User.
user.passwordChangeRequired [Boolean]	Indicates that the User’s password needs to be changed during their next login attempt.
user.passwordLastUpdateInstant [Long]	The instant that the User last changed their password.
user.preferredLanguages [Array<String>]	An array of locale strings that give, in order, the User’s preferred languages. These are important for email templates and other localizable text. See Locales.
user.registrations [Array]	The list of registrations for the User.
user.registrations`[x]`.applicationId [UUID]	The Id of the Application that this registration is for.
user.registrations`[x]`.authenticationToken [String]	The Authentication Token for this registration (if one exists).
user.registrations`[x]`.cleanSpeakId [UUID]	This Id is used by FusionAuth when the User’s username for this registration is sent to CleanSpeak to be moderated (filtered and potentially sent to the approval queue). It is the content Id of the username inside CleanSpeak.
user.registrations`[x]`.data [Object]	An object that can hold any information about the User for this registration that should be persisted.
user.registrations`[x]`.id [UUID]	The Id of this registration.
user.registrations`[x]`.insertInstant [Long]	The instant that this registration was created.
user.registrations`[x]`.lastLoginInstant [Long]	The instant that the User last logged into the Application for this registration.
user.registrations`[x]`.preferredLanguages [Array<String>]	An array of locale strings that give, in order, the User’s preferred languages for this registration. These are important for email templates and other localizable text.
user.registrations`[x]`.roles [Array<String>]	The list of roles that the User has for this registration.
user.registrations`[x]`.timezone [String]	The User’s preferred timezone for this registration.
user.registrations`[x]`.tokens [Map<String,String>] Available Since 1.1.0	A map that contains tokens returned from identity providers. For example, if this user has authenticated using the Facebook Identity Provider, the Facebook access token will be available in this map, keyed by name `Facebook`. For an OpenID Connect Identity provider, or other generic providers, if a token is stored it will be keyed by the Identity Provider unique Id.
user.registrations`[x]`.username [String]	The username of the User for this registration only.
user.registrations`[x]`.usernameStatus [String]	The current status of the username. This is used if you are moderating usernames via CleanSpeak. The possible values are: `ACTIVE` - the username is active `PENDING` - the username is pending approval/moderation `REJECTED` - the username was rejected during moderation If a username has been rejected, it is still possible to allow the User to update it and have the new one moderated again.
user.registrations`[x]`.verified [Boolean]	This value indicates if this User’s registration has been verified.
user.timezone [String]	The User’s preferred timezone. This can be used as a default to display instants. It is recommended that you allow User’s to change this per-session.
user.twoFactorDelivery [String]	The User’s preferred delivery for verification codes during a two factor login request. The possible values are: `None` `TextMessage`
user.twoFactorEnabled [Boolean]	Determines if the User has two factor authentication enabled for their account or not.
user.username [String]	The username of the User.
user.usernameStatus [String]	The current status of the username. This is used if you are moderating usernames via CleanSpeak. The possible values are: `ACTIVE` - the username is active `PENDING` - the username is pending approval/moderation `REJECTED` - the username was rejected during moderation If a username has been rejected, it is still possible to allow the User to update it and have the new one moderated again.
user.verified [Boolean]	Whether or not the User’s email has been verified.

Example Response JSON

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE0ODUxNDA5ODQsImlhdCI6MTQ4NTEzNzM4NCwiaXNzIjoiYWNtZS5jb20iLCJzdWIiOiIyOWFjMGMxOC0wYjRhLTQyY2YtODJmYy0wM2Q1NzAzMThhMWQiLCJhcHBsaWNhdGlvbklkIjoiNzkxMDM3MzQtOTdhYi00ZDFhLWFmMzctZTAwNmQwNWQyOTUyIiwicm9sZXMiOltdfQ.Mp0Pcwsz5VECK11Kf2ZZNF_SMKu5CgBeLN9ZOP04kZo",
  "user": {
    "active": true,
    "birthDate": "1976-05-30",
    "data": {
      "displayName": "Johnny Boy",
      "favoriteColors": [
        "Red",
        "Blue"
      ]
    },
    "email": "example@fusionauth.io",
    "expiry": 1571786483322,
    "firstName": "John",
    "fullName": "John Doe",
    "id": "00000000-0000-0001-0000-000000000000",
    "imageUrl": "http://65.media.tumblr.com/tumblr_l7dbl0MHbU1qz50x3o1_500.png",
    "lastLoginInstant": 1471786483322,
    "lastName": "Doe",
    "middleName": "William",
    "mobilePhone": "303-555-1234",
    "passwordChangeRequired": false,
    "passwordLastUpdateInstant": 1471786483322,
    "preferredLanguages": [
      "en",
      "fr"
    ],
    "registrations": [
      {
        "applicationId": "10000000-0000-0002-0000-000000000001",
        "data": {
          "displayName": "Johnny",
          "favoriteSports": [
            "Football",
            "Basketball"
          ]
        },
        "id": "00000000-0000-0002-0000-000000000000",
        "insertInstant": 1446064706250,
        "lastLoginInstant": 1456064601291,
        "preferredLanguages": [
          "en",
          "fr"
        ],
        "roles": [
          "user",
          "community_helper"
        ],
        "tokens": {
          "Facebook": "nQbbBIzDhMXXfa7iDUoonz5zS",
          "19544aa2-d634-4859-b193-e57af82b5d12": "eu1SsrjsiDf3h3LryUjxHIKTS0yyrbiPcsKF3HDp"
        },
        "username": "johnny123",
        "usernameStatus": "ACTIVE"
      }
    ],
    "timezone": "America/Denver",
    "twoFactorEnabled": false,
    "usernameStatus": "ACTIVE",
    "username": "johnny123",
    "verified": true
  }
}

Table 10. Response Cookies
access_token [String]	The encoded access token. This cookie is written in the response as an HTTP Only session cookie.
refresh_token [String]	The refresh token. This cookie is written in the response as an HTTP Only persistent cookie. The cookie expiration is configured in the JWT configuration for the application or the global JWT configuration.
fusionauth.trust [String]	The Two Factor Trust identifier. This value is returned when `trustComputer` was set to `true` on the request. This value can be used by subsequent login requests to bypass the Two Factor challenge. This cookie is written in the response as an HTTP Only persistent cookie.

Sends a ping to FusionAuth indicating that the user was automatically logged into an application. When using FusionAuth’s SSO or your own, you should call this if the user is already logged in centrally, but accesses an application where they no longer have a session. This helps correctly track login counts, times and helps with reporting.

4.1. Request

Update the login instant for a given User and Application

URI

PUT /api/login/{userId}/{applicationId}?ipAddress={ipAddress}

Table 11. Request Headers
X-Forwarded-For [String] Optional	The IP address of a client requesting authentication. If the IP address is provided it will be stored for login history of the user. It is generally preferred to specify the IP address in the request body. If it is not provided in the request body this header value will be used if available, the request body value will take precedence.

Table 12. Request Parameters
userId [UUID] Required	The Id of the user logging in.
applicationId [UUID] Required	The Id of the Application the user is logging into.
ipAddress [String] Optional	The IP address of the end-user that is logging into FusionAuth. If this value is omitted FusionAuth will attempt to obtain the IP address of the client, the value will be that of the `X-Forwarded-For` header if provided or the last proxy that sent the request. The IP address will be stored in the User login history.

Update the login instant for a given User and Application using a JWT

URI

PUT /api/login?ipAddress={ipAddress}

The userId and applicationId are not required on the request, these values will be retrieved from the identity claims in the JWT payload.

Table 13. Request Parameters
ipAddress [String] Optional	The IP address of the end-user that is logging into FusionAuth. If this value is omitted FusionAuth will attempt to obtain the IP address of the client, the value will be that of the `X-Forwarded-For` header if provided or the last proxy that sent the request. The IP address will be stored in the User login history.

4.2. Response

This API does not return a JSON response body.

Table 14. Response Codes
Code	Description
200	The update was successful.
202	The user exists but is not registered for the application specified by applicationId on the request.
400	The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors.
401	You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
404	The user was not found.
500	There was an internal error. A stack trace is provided and logged in the FusionAuth log files.
503	The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

5. Logout a User

The Logout API is intended to be used to remove the refresh token and access token cookies if they exist on the client and revoke the refresh token. This API does nothing if the request does not contain an access token or refresh token cookies.

5.1. Request

Remove the access_token and refresh_token cookies if they exist on the client.

URI

POST /api/logout?global={global}&refreshToken={refreshToken}

Table 15. Request Parameters
global [Boolean] Optional	When this value is set to true all of the refresh tokens issued to the owner of the provided refresh token will be revoked.
refreshToken [String] Optional	The `refresh_token` as a request parameter instead of coming in via a cookie. If provided this takes precedence over the cookie.

5.2. Response