john-okeefe
f65db5ab4f
Verified against the Echo routes and handler structs, fixing drift that
would break API clients:
- login: response field is access_token, not token (AuthResponse struct)
- register status: status is only pending|approved; expiry is HTTP 410
(not a status value), approved responses are single-use, and pending
registrations do not survive server restarts
- visible libraries: endpoint is GET /api/libraries/visibility and
returns a top-level array of full library rows, not a wrapped object
- media items list: response is {"data": [...]}, library_id is optional,
limit defaults to 50 (max 1000), no total field; document the sort
parameter, the two response shapes, and raw-vs-resolved file paths
refresh and device-registration docs verified accurate; no changes.
1.4 KiB
1.4 KiB
Login User
Authenticate with email and password.
Endpoint: POST /api/auth/login
Auth: Not required
Content-Type: application/json or application/x-www-form-urlencoded
Request Body
| Field | Type | Required | Description |
|---|---|---|---|
| login | string | Yes | User's email address or username |
| password | string | Yes | User's password |
Example Request
{
"login": "user@example.com",
"password": "SecureP@ss123!"
}
Response (200 OK)
{
"access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"refresh_token": "d4f5g6h7...",
"token_type": "Bearer",
"expires_in": 604800,
"user": {
"id": "uuid-here",
"email": "user@example.com",
"username": "john",
"first_name": "John",
"last_name": "Doe",
"role": "user"
}
}
Note: the access token field is access_token (not token). Nullable profile fields (first_name, last_name) may be empty strings.
Set-Cookie Header:
Set-Cookie: token=eyJhbG...; Max-Age=604800; Path=/; HttpOnly
Session Duration: 7 days (604800 seconds)
Error Responses
| Code | Description |
|---|---|
| 401 | Invalid email or password |
| 400 | Missing required fields |
| 429 | Too many login attempts |