Login endpoint
| Method | POST |
|---|
| Route | /api/Authenication/login |
|---|
| Auth | Anonymous access allowed |
|---|
| Input | username and password in the JSON request body |
|---|
| Response | Logged-in user object including id, userType, token, and expiry |
|---|
POST /api/Authenication/login
Content-Type: application/json
{
"username": "partner@example.com",
"password": "your-password"
}
{
"firstName": "string",
"lastName": "string",
"id": "string",
"email": "string",
"username": "string",
"userType": "Partner",
"token": "eyJhbGciOiJIUzI1NiIs...",
"expiresUTC": "2026-03-30T00:00:00Z",
"requiresTwoFactor": false
}
Refresh token endpoint
| Method | POST |
|---|
| Route | /api/Authenication/refresh-token |
|---|
| Auth | Bearer token required |
|---|
| Input | No body |
|---|
| Response | String token value |
|---|
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...
Portal behavior
The webhook admin only allows partner accounts. If userType is not Partner, login is rejected.
The portal uses the returned id as the partner ID automatically.
Credentials are accepted only in the JSON request body; query-string login is not supported.
