POST /auth/login

Exchange credentials for an MFA challenge id. If MFA is disabled for the account, returns a token pair directly.

Request

{
  "email": "alice@example.com",
  "password": "hunter22!hunter22"
}

Response 200 is a discriminated union on status:

{
  "status": "mfa_required",
  "challenge_id": "mfa_b4bd0c1d8e2f4a6b9d3c"
}

{
  "status": "tokens",
  "access_token": "eyJhbGciOi…",
  "refresh_token": "rt_…",
  "access_expires_at": "2026-04-23T10:15:00Z",
  "refresh_expires_at": "2026-05-23T10:00:00Z"
}

The challenge_id is opaque, single-use, and expires ~5 minutes after issue. Redeem it at POST /auth/mfa/verify with the user's TOTP code.

Errors: 401 (bad creds).

Example

curl -X POST "$SEISMIC_ORCHESTRATION_URL/v0/auth/login" \
  -H "content-type: application/json" \
  -d '{
    "email": "alice@example.com",
    "password": "hunter22!hunter22"
  }'

See LoginResponse for the full shape.