1. Docs
  2. API Reference
  3. LoginResponseDto

LoginResponseDto

Example

JSON
{
  "mfa_enrollment_pending": false,
  "grace_expires_at": "2026-04-20T12:00:00.000Z",
  "requires_mfa_enrollment": false,
  "mfa_enrollment": {
    "enrollment_token": "string",
    "available_factors": [
      "totp"
    ],
    "totp": {
      "otpauth_uri": "string",
      "manual_entry_key": "string"
    }
  },
  "requires_account_selection": false,
  "requires_mfa_challenge": false,
  "mfa_challenge": {
    "challenge_token": "string",
    "available_factors": [
      "totp"
    ],
    "expires_at": "2026-04-20T12:00:00.000Z"
  },
  "device_remembered": false,
  "recovery_codes": [
    "string"
  ],
  "expires_in": 0,
  "user": {
    "id": "string",
    "email": "string",
    "first_name": "string",
    "last_name": "string"
  },
  "access_token": "string",
  "token_type": "string",
  "default_environment_slug": "string",
  "accounts": [
    {
      "account_id": "string",
      "account_name": "string",
      "account_slug": "string",
      "account_role": "string",
      "applications": [
        {
          "id": "string",
          "name": "string",
          "slug": "string"
        }
      ]
    }
  ],
  "pending_account_creation": false
}

Properties

16 properties 2 required

mfa_enrollment_pending boolean Optional

True when the Account requires a second factor, the administrator holds none, and the grace window still has time. The session is issued; nudge the person to enroll before `grace_expires_at`.

grace_expires_at string Optional

Deadline by which the administrator must enroll a factor; after it, entering the Account issues no session and answers `requires_mfa_enrollment` instead.

format: date-time
requires_mfa_enrollment boolean Optional

True when the Account requires a second factor, the administrator holds none, and no grace remains. No session is issued; enroll a first factor via `/v1/auth/login/mfa-enroll/*` with `mfa_enrollment.enrollment_token`.

mfa_enrollment UserMfaEnrollmentPromptDto Optional
requires_account_selection boolean Required
requires_mfa_challenge boolean Optional

True when the password was right and the administrator holds a second factor. No session is issued; answer `mfa_challenge` at one of the `/v1/auth/mfa/challenge/*` endpoints.

mfa_challenge UserMfaChallengePromptDto Optional
device_remembered boolean Optional

Present when a challenge was answered with `remember_device: true`: whether this device is now remembered. False when one of the user's Accounts sets `trusted_device_days` to 0, in which case nothing was stored and the next sign-in is challenged again.

recovery_codes array of string Optional

Present when a sign-in was completed by enrolling a first factor: the ten single-use recovery codes, shown here and never again.

expires_in number Required
user AuthUserDto Optional
access_token string Optional
token_type string Optional
default_environment_slug string Optional
accounts array of AuthAccountDto Optional
pending_account_creation boolean Optional
Was this page helpful?

Tell us how we can improve this guide.

Canopy