API Scripts are recommended to use the Login call instead of separate Authentication & Authorization calls.
First step for logging in is sending the credentials and retrieving partial AuthToken. If the response has the "needTwoFactorAuth:true", then either API user must be extempt from Admin MFA or two-step MFA process must be completed before Authorization.
Login Credentials.
Display name of the Identity Provider name.
Username. Required if a credentials based Identity Provider is used.
Password. Required if a credentials based Identity Provider is used.
UUID to distinguish the Client device making the request. It is supposed to be same for every login request from the same server.
SAMLResponse received from SAML provider. Required if a SAML based Identity Provider is used.
ID Token received from OIDC provider. Required if an OIDC based Identity Provider is used.
Access Token received from OIDC provider. Required if an OIDC based Identity Provider is used.
Login Response.
Information about logged in user, such as username and email address, if exists.
Username.
If true, it is not possible to complete login process without providing MFA.
Whether there is a LogServer deployed and the user has privileges to access to it.
The privileges the user has.
Administrative Privilege item. Use type-target-map API to get the details on which types are valid for which targets and their scopes.
The type of the Privilege defines the possible administrator actions.
The target of the Privilege defines the possible target objects for that type.
The scope of the Privilege. Only applicable to certain type-target combinations. Some types depend on the IdP/MFA type, such as GetUserAttributes. This field must be omitted if not applicable.
'If "true", all objects are accessible. For example, "type: Edit - target: Condition - scope.all: true" means the administrator can edit all Conditions in the system.'
Specific object IDs this Privilege would have access to.
Object tags this privilege would have access to.
The items in this list would be added automatically to the newly created objects' tags. Only applicable on "Create" type and targets with tagging capability. This field must be omitted if not applicable.
Privilege for changing Appliance Functions. Only applicable on "AssignFunction" type with Appliance or All target. This field must be omitted if not applicable.
The AuthToken required for subsequent API calls.
Token expiration time.
Message of the day configured by an admin.
ZTP type of the collective.
ZTP account type.
Whether X509 CRL is enabled for the system or not. Issued Certificates is disabled if it's not enabled.
JSON error. Check the JSON format.
Generic HTTP error.
Machine readable error code.
Human readable error details.
Login Failed.
Machine readable error code.
Human readable error details.
The authentication failure reason.
Invalid 'Accept' header.
Generic HTTP error.
Machine readable error code.
Human readable error details.
Request validation error. Check "errors" array for details.
Http 422 error for object validation.
Machine readable error code.
Human readable error details.
List of fields with validation errors.
Name of the field that failed validation.
Failure reason.
Unexpected server side error.
Generic HTTP error.
Machine readable error code.
Human readable error details.