> ## Documentation Index > Fetch the complete documentation index at: https://docs.oms.verolabs.co/llms.txt > Use this file to discover all available pages before exploring further. # Submit password credentials to a login flow > Submit password credentials to a login flow ## OpenAPI ````yaml openapi.docs.en.json POST /api/authen/self-service/login openapi: 3.0.3 info: title: Vero OMS REST API version: 1.0.24 description: >- REST API documentation for Vero OMS. Paths are aligned with the active KrakenD gateway config under k8s-dev-gitops/vero-algo/tools/krakend and response schemas are expanded from backend/frontend source models. servers: - url: https://api-gw.verolabs.co description: API gateway security: [] tags: - name: Auth description: Authentication flows and app logout - name: Signup description: APIs used during account signup - name: Accounts description: User accounts, balances, positions, deposits and withdrawals - name: Bank Accounts description: Saved bank account management - name: Orders description: Order placement, cancellation, modification and order history - name: History description: Account orders, trades and cash transactions. - name: Market Data description: Watchlists, symbol search, product master and OHLCV history - name: Notifications description: In-app notifications - name: Referral description: Referral code, rebate and commission summary APIs - name: Diagnostics description: Health and diagnostic endpoints paths: /api/authen/self-service/login: post: tags: - Auth summary: Submit password credentials to a login flow operationId: submitLoginFlow parameters: - $ref: '#/components/parameters/Flow' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/LoginFlowUpdateRequest' description: >- self-service flow update payload. Pass the flow id in the query string and include the fields required by the selected method. responses: '200': description: >- Successful login flow response. The app reads session_token from this payload and uses it as the authenticated session token. content: application/json: schema: $ref: '#/components/schemas/LoginResponse' '400': $ref: '#/components/responses/AuthFlowError' description: Error response. content: application/json: schema: $ref: '#/components/schemas/AnyErrorBody' application/problem+json: schema: oneOf: - $ref: '#/components/schemas/ValidationProblemDetails' - $ref: '#/components/schemas/ProblemDetails' text/plain: schema: type: string description: Plain-text backend or gateway error message. '401': $ref: '#/components/responses/ErrorResponse' description: Error response. content: application/json: schema: $ref: '#/components/schemas/AnyErrorBody' application/problem+json: schema: oneOf: - $ref: '#/components/schemas/ValidationProblemDetails' - $ref: '#/components/schemas/ProblemDetails' text/plain: schema: type: string description: Plain-text backend or gateway error message. '404': $ref: '#/components/responses/ErrorResponse' description: Error response. content: application/json: schema: $ref: '#/components/schemas/AnyErrorBody' application/problem+json: schema: oneOf: - $ref: '#/components/schemas/ValidationProblemDetails' - $ref: '#/components/schemas/ProblemDetails' text/plain: schema: type: string description: Plain-text backend or gateway error message. '500': $ref: '#/components/responses/ErrorResponse' description: Error response. content: application/json: schema: $ref: '#/components/schemas/AnyErrorBody' application/problem+json: schema: oneOf: - $ref: '#/components/schemas/ValidationProblemDetails' - $ref: '#/components/schemas/ProblemDetails' text/plain: schema: type: string description: Plain-text backend or gateway error message. default: $ref: '#/components/responses/Error' description: Error response. content: application/json: schema: $ref: '#/components/schemas/AnyErrorBody' application/problem+json: schema: oneOf: - $ref: '#/components/schemas/ValidationProblemDetails' - $ref: '#/components/schemas/ProblemDetails' text/plain: schema: type: string description: Plain-text backend or gateway error message. security: [] components: parameters: Flow: name: flow in: query required: true schema: type: string description: >- Flow identifier returned by the matching create-flow endpoint. Submit/update requests must use the same flow id. schemas: LoginFlowUpdateRequest: type: object required: - method - csrf_token - password_identifier - password properties: method: type: string enum: - password description: >- Authentication method. The mobile/web client submits password for password login. csrf_token: type: string description: CSRF token copied from the login flow UI node when required. password_identifier: type: string format: email description: User login identifier. The app sends the account email address. password: type: string format: password description: Plain-text password entered by the user. Send only over HTTPS. description: JSON payload used to submit password credentials to an login flow. LoginResponse: type: object additionalProperties: true properties: session_token: type: string description: Bearer/session token used by the client for authenticated API calls. session: $ref: '#/components/schemas/AuthSession' description: session object for the authenticated identity. identity: type: object additionalProperties: true description: >- identity object. Includes identity id and traits when returned by the system. description: Response returned after a successful API login flow. AnyErrorBody: oneOf: - $ref: '#/components/schemas/ErrorResponse' - $ref: '#/components/schemas/ValidationProblemDetails' - $ref: '#/components/schemas/ProblemDetails' - $ref: '#/components/schemas/AuthFlow' description: >- Structured error body returned by gateway, ASP.NET services, or backend validation handlers. ValidationProblemDetails: allOf: - $ref: '#/components/schemas/ProblemDetails' - type: object additionalProperties: true properties: errors: type: object additionalProperties: oneOf: - type: array items: type: string - type: string description: Validation errors keyed by request field name. description: >- Validation problem response returned when request parameters or body fields are invalid. ProblemDetails: type: object additionalProperties: true description: RFC 7807-style problem response returned by ASP.NET/gateway services. properties: type: type: string description: Problem type URI. title: type: string description: Short problem title. status: type: integer description: HTTP status code. detail: type: string description: Detailed error message. traceId: type: string description: Trace id for backend diagnostics. AuthSession: type: object additionalProperties: true properties: id: type: string description: session id. active: type: boolean description: Whether the session is currently active. identity: type: object additionalProperties: true properties: id: type: string description: identity id for the authenticated user. traits: type: object additionalProperties: true description: Identity profile attributes stored by, such as email and name. schema_id: type: string description: identity schema id. schema_url: type: string description: URL of the identity schema. state: type: string description: identity state, for example active. state_changed_at: type: string description: Timestamp when the identity state last changed. format: date-time recovery_addresses: type: array description: Recovery addresses configured on the identity. items: type: object additionalProperties: true metadata_public: nullable: true description: Public identity metadata returned by the system; can be null. type: object additionalProperties: true created_at: type: string description: Identity creation timestamp. format: date-time updated_at: type: string description: Identity update timestamp. format: date-time organization_id: type: string nullable: true description: >- organization id when the identity belongs to an organization; null otherwise. description: >- Authenticated identity object, including id, schema metadata, state, traits, recovery addresses, and timestamps. tokenized: type: string description: >- Bearer token returned when tokenize_as is supplied and returns a tokenized session. expires_at: type: string description: Timestamp when the session expires. format: date-time authenticated_at: type: string description: Timestamp when the user authenticated for this session. format: date-time authenticator_assurance_level: type: string description: authenticator assurance level for the session, for example aal1. authentication_methods: type: array description: Authentication methods completed for the session. items: type: object additionalProperties: true properties: method: type: string description: Authentication method name, for example password. aal: type: string description: Assurance level completed by this method. completed_at: type: string description: Timestamp when this method completed. format: date-time issued_at: type: string description: Timestamp when issued the session. format: date-time devices: type: array description: >- Device/session metadata returned by the system, including device id, IP address, user agent, and location. items: type: object additionalProperties: true properties: id: type: string description: device ID. ip_address: type: string description: IP address observed for the session/device. user_agent: type: string description: User agent observed for the session/device. location: type: string description: Location string returned by the system when available. description: session returned by whoami and login responses. AuthFlow: type: object additionalProperties: true properties: id: type: string description: >- Flow id. Use this value as the flow query parameter when submitting or updating the flow. type: type: string description: Flow type returned by the system, for example browser or api. expires_at: type: string format: date-time description: Timestamp when the flow expires. Submit the flow before this time. issued_at: type: string format: date-time description: Timestamp when created the flow. ui: type: object additionalProperties: true description: >- UI payload containing action URL, method, nodes, messages, and CSRF node when required. state: type: string description: >- Current flow state, such as choose_method, sent_email, passed_challenge, or success. request_url: type: string description: Original request URL used to create the flow. organization_id: type: string nullable: true description: organization id for organization-scoped flows, when supplied. created_at: type: string description: Flow creation timestamp. format: date-time updated_at: type: string description: Flow update timestamp. format: date-time refresh: type: boolean description: Whether the flow is a refresh flow. requested_aal: type: string description: Requested authenticator assurance level for the flow. identity: allOf: - 9cb587e8-c15a-435c-916a-4854d0ffa2c6 description: Identity attached to settings flows when the system includes it. description: >- self-service flow object returned by login, registration, recovery, and settings create/update endpoints. ErrorResponse: type: object additionalProperties: true description: >- Error body returned by gateway or backend services. Backends can return either JSON objects or plain text errors. properties: error: oneOf: - type: string - type: object additionalProperties: true properties: id: type: string description: gateway error id when supplied. code: type: integer description: HTTP-like error code. status: type: string description: HTTP status text, for example Unauthorized. reason: type: string description: >- Detailed reason returned by the authentication service or gateway. message: type: string description: Human-readable error message. description: Error code/message string or nested gateway error object. message: type: string description: Human-readable error message. detail: type: string description: Detailed backend error message when available. details: oneOf: - type: string - type: object additionalProperties: true - type: array items: type: object additionalProperties: true description: Additional validation or backend details. nullable: true status: type: integer description: HTTP status code when included by the backend. responses: AuthFlowError: description: Authentication flow validation error. content: application/json: schema: $ref: '#/components/schemas/AuthFlow' ErrorResponse: description: Error response containing an error code, message, detail, or plain text. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' text/plain: schema: type: string Error: description: Error response. The app reads detail or message when available. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' text/plain: schema: type: string ````