# User Login

Authenticate user, confirm multi-factor authentication and return access tokens

Endpoint: POST /auth/login
Version: 2.0.0
Security: bearerToken

## Request fields (application/json):

  - `username` (string, required)
    User's email address

  - `password` (string, required)
    User's password

  - `invitation` (string)
    Optional invitation token

  - `session` (string)
    MFA session token (if continuing MFA flow)

  - `code` (string)
    MFA verification code (if continuing MFA flow)

## Response 200 fields (application/json):

  - `Token` (object)
    Authentication tokens

  - `Token.AccessToken` (string)
    JWT access token for API requests

  - `Token.RefreshToken` (string)
    Token for refreshing access tokens

  - `Token.IdToken` (string)
    ID token containing user identity claims

  - `UserInfo` (object)

  - `UserInfo.userId` (string)
    Unique identifier for the user (UUID)

  - `UserInfo.username` (string)
    User's email address

  - `UserInfo.email` (string)
    User's email address

  - `UserInfo.givenName` (string)
    User's first name

  - `UserInfo.familyName` (string)
    User's last name

  - `UserInfo.mfa` (boolean)
    Whether multi-factor authentication is enabled

  - `Settings` (object)
    User settings including default tenant

  - `Settings.default` (object)

  - `Settings.default.tenant` (string)
    Default tenant domain prefix