iRetail PRO store node 1.0.0-m1: auth
2 operations
← All documentation · Source: contracts openapi/store-v1.yaml at 8000474.
← iRetail PRO store node 1.0.0-m1
Operations
POST
/v1/auth/login
Log an employee in on this device; the device token authorizes the call.
Attempts count per login and device, before the PIN is checked; five wrong in a row pause the pair for a minute, doubling to an hour (429 too_many_requests, details limit pin and retry_after). A PIN shorter than 6 digits signs in with pin_change_required (spec/RBAC.md, PINs).
operationId
login
Parameters
| Name | In | Type | Description |
|---|---|---|---|
IRetail-App
|
header | string |
Which app sends the request, at which version: <app>/<version>, optionally a space and (<platform>), as cashier/1.2.0 (windows-x64) or manager/1.2.0 (web). The register (cashier), the back office and the console (manager) and the device gateway (gateway) send it on every request; a request without it is not one of the apps and is served as the current API, and a device token of an app's kind without it is an app of an unknown version; a header that does not parse counts as absent. The node may refuse an app 426 app_update_required by it, except on the operations marked x-app-update-exempt. Not a security boundary (spec/API.md, Transport; spec/RELEASES.md, Who is asking). |
Request body required
application/jsonLoginRequest
Responses
POST
/v1/auth/logout
Revoke the presented employee token.
operationId
logout
Parameters
| Name | In | Type | Description |
|---|---|---|---|
IRetail-App
|
header | string |
Which app sends the request, at which version: <app>/<version>, optionally a space and (<platform>), as cashier/1.2.0 (windows-x64) or manager/1.2.0 (web). The register (cashier), the back office and the console (manager) and the device gateway (gateway) send it on every request; a request without it is not one of the apps and is served as the current API, and a device token of an app's kind without it is an app of an unknown version; a header that does not parse counts as absent. The node may refuse an app 426 app_update_required by it, except on the operations marked x-app-update-exempt. Not a security boundary (spec/API.md, Transport; spec/RELEASES.md, Who is asking). |
Responses
-
204Done -
401Error (spec/API.md).Error
Schemas
Error object
Every error response.
error required
|
string |
Stable code, see spec/API.md. |
message required
|
string |
English text for logs. |
details
|
object |
EffectivePermission object
code required
|
string |
|
limit required
|
integer (int64) | null |
LoginRequest object
login required
|
string |
|
pin required
|
string |
Four or five digits only for a PIN set before 1.0, which then must change (spec/RBAC.md, PINs). |
Session object
token required
|
string |
Shown once. |
expires_at required
|
string (date-time) |
|
employee required
|
Employee |
|
store_id required
|
string (uuid) |
|
workplace_id required
|
string (uuid) |
|
permissions required
|
array of EffectivePermission |
|
pin_change_required
|
boolean |
The PIN is shorter than 6 digits; until PUT /v1/me/pin the session answers 403 pin_change_required to everything else (spec/RBAC.md, PINs). Absent or false otherwise. |
Assignment object
id required
|
string (uuid) |
|
role required
|
string |
|
scope required
|
"network" | "store" | "workplace" |
|
store_id required
|
string (uuid) | null |
|
workplace_id required
|
string (uuid) | null |
Employee object
id required
|
string (uuid) |
|
login required
|
string |
|
display_name required
|
string |
|
language required
|
string |
|
active required
|
boolean |
|
assignments required
|
array of Assignment |
|
version required
|
integer (int64) |