Login

POST /v1/auth/login

Exchanges a user’s email and password for a session token. Use the token in the Authorization: Bearer <token> header of later requests. Use this endpoint in apps where a person signs in (web, mobile). Server integrations use an API key instead. The wede dashboard signs in through the same endpoint but keeps its session in an HttpOnly cookie, so the token never reaches scripts in the browser. Your apps receive the token in the response body, as shown below.

Authentication

None. The endpoint is public.

Request body

string

required

Email address of an active user.

string

required

The user’s password.

Example

curl -X POST https://api.wede.pt/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "ops@example.com",
    "password": "your-password"
  }'

Response

200 OK

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expires_in": 28800,
  "user": {
    "id": "5b1f0c2e-7a4d-4f38-9a51-0c6f2d8e9b13",
    "email": "ops@example.com",
    "name": "Ana Costa",
    "rbac_level": "company_admin",
    "demo_mode": false,
    "verticals": ["healthcare"]
  }
}

string

Session token. Send it as Authorization: Bearer <token>.

integer

Lifetime of the token in seconds. Always 28800 (8 hours).

object

Show properties

string

User ID (UUID).

string

User email.

string

User name.

string

The user’s role. It decides which endpoints the token can call. Tenant roles: company_admin, company_tech, operational_supervisor, field_operator, corporate_client.

boolean

true while the account is not yet linked to an organisation. See Register.

string[]

Verticals the user works in.

Account lockout

After 5 consecutive failed attempts for the same account, the account is locked for 15 minutes and every sign-in returns 429 account_locked, even with the right password. A successful sign-in resets the counter. The user can also regain access by resetting the password.

Errors

Status	Code	When
400	`validation_error`	`email` or `password` is missing
401	`unauthorized`	The email does not belong to an active user, or the password is wrong. The response does not say which
429	`account_locked`	The account is temporarily locked. The body includes `locked_until` (ISO 8601)
500	`internal_error`	Unexpected error. Retry

{
  "error": "account_locked",
  "message": "...",
  "locked_until": "2026-09-26T10:45:00.000Z"
}

Overview

Authentication

Events

Teams & Dispatch

Missions

Zones

Billing

Tenant

Webhooks

Sync

Policies

Connectivity

Sandbox

Parsers

Onboarding

Authentication

Request body

Example

Response

Account lockout

Errors

​Authentication

​Request body

​Example

​Response

​Account lockout

​Errors

Authentication

Request body

Example

Response

Account lockout

Errors