Authentication
Sign in, renew and end sessions; invitation, first access, password change and recovery.
Accept the invitation and set the password
POST /auth/aceitar-convite
Access: Public (no sign-in). Rate limit: up to 10 calls every 60 s per origin. Success status: 200.
Headers
| Parameter | Type | Required | Constraints | Description |
|---|---|---|---|---|
user-agent | string | no | Client application identification; stored for the connections list. |
Request body (AceitarConviteInput)
| Field | Type | Required | Constraints | Description |
|---|---|---|---|---|
token | string | yes | 20–200 characters | |
senha | Senha | yes | ||
nationality | string | no | 2–2 characters; ^[A-Za-z]{2}$ | |
locale | "pt-BR" | "es" | "en-US" | no | ||
aceites | list of object | no | 0–4 items; default: [] | Accepted terms (version of the current document). |
aceites[].documento | "TERMO_USO" | "POLITICA_PRIVACIDADE" | yes | ||
aceites[].versao | string | yes | 1–20 characters |
Response
| Field | Type | Required | Constraints | Description |
|---|---|---|---|---|
accessToken | string | yes | ||
refreshToken | string | yes | ||
expiresIn | integer | yes | Access token lifetime, in seconds. | |
usuario | Me | yes |
On error: ErroApi model.
Example
curl -X POST "$API/auth/aceitar-convite" -H "Content-Type: application/json" -d '{"token":"texto","senha":"texto"}'Request the password recovery email
POST /auth/esqueci-senha
Always answers the same way, whether or not the email exists, so as not to reveal who is registered.
Access: Public (no sign-in). Rate limit: up to 5 calls every 60 s per origin. Success status: 202.
Request body (EsqueciSenhaInput)
| Field | Type | Required | Constraints | Description |
|---|---|---|---|---|
email | yes |
Response
No response body.
On error: ErroApi model.
Example
curl -X POST "$API/auth/esqueci-senha" -H "Content-Type: application/json" -d '{"email":"texto"}'Sign in with email and password
POST /auth/login
Returns accessToken (valid for 15 minutes) and refreshToken (single use, up to 30 days). Five consecutive failures within 15 minutes block the attempt with 429 and retryAfterSeg.
Access: Public (no sign-in). Rate limit: up to 20 calls every 60 s per origin. Success status: 200.
Headers
| Parameter | Type | Required | Constraints | Description |
|---|---|---|---|---|
user-agent | string | no | Client application identification; stored for the connections list. |
Request body (LoginInput)
| Field | Type | Required | Constraints | Description |
|---|---|---|---|---|
email | yes | |||
senha | Senha | yes |
Response
| Field | Type | Required | Constraints | Description |
|---|---|---|---|---|
accessToken | string | yes | ||
refreshToken | string | yes | ||
expiresIn | integer | yes | Access token lifetime, in seconds. | |
usuario | Me | yes |
On error: ErroApi model.
Example
curl -X POST "$API/auth/login" -H "Content-Type: application/json" -d '{"email":"texto","senha":"texto"}'End the session of a refresh token
POST /auth/logout
Access: Public (no sign-in). Rate limit: up to 60 calls every 60 s per origin. Success status: 204.
Request body (LogoutInput)
| Field | Type | Required | Constraints | Description |
|---|---|---|---|---|
refreshToken | string | yes | 20–200 characters | |
dispositivoToken | string | no | 8–4096 characters; ^[\x21-\x7E]+$ |
Response
No response body.
On error: ErroApi model.
Example
curl -X POST "$API/auth/logout" -H "Content-Type: application/json" -d '{"refreshToken":"texto"}'End all of the account's sessions
POST /auth/logout-todas
Access: Any signed-in person. Success status: 204.
Response
No response body.
On error: ErroApi model.
Example
curl -X POST "$API/auth/logout-todas" -H "Authorization: Bearer $TOKEN"Signed-in person's data and bindings
GET /auth/me
Access: Any signed-in person. Success status: 200.
Response
| Field | Type | Required | Constraints | Description |
|---|---|---|---|---|
id | string (uuid) | yes | ||
email | string | yes | ||
nome | string | yes | ||
locale | "pt-BR" | "es" | "en-US" | yes | ||
nationality | string or null | yes | ||
vinculos | list of VinculoDto | yes |
On error: ErroApi model.
Example
curl -X GET "$API/auth/me" -H "Authorization: Bearer $TOKEN"Request the first-access code
POST /auth/primeiro-acesso/codigo
Access: Public (no sign-in). Rate limit: up to 5 calls every 60 s per origin. Success status: 202.
Request body (PrimeiroAcessoSolicitarInput)
| Field | Type | Required | Constraints | Description |
|---|---|---|---|---|
email | yes |
Response
No response body.
On error: ErroApi model.
Example
curl -X POST "$API/auth/primeiro-acesso/codigo" -H "Content-Type: application/json" -d '{"email":"texto"}'Confirm first access with the code
POST /auth/primeiro-acesso/confirmar
Access: Public (no sign-in). Rate limit: up to 10 calls every 60 s per origin. Success status: 200.
Headers
| Parameter | Type | Required | Constraints | Description |
|---|---|---|---|---|
user-agent | string | no | Client application identification; stored for the connections list. |
Request body (PrimeiroAcessoConfirmarInput)
| Field | Type | Required | Constraints | Description |
|---|---|---|---|---|
email | yes | |||
codigo | string | yes | ^\d{6}$ | |
senha | Senha | yes |
Response
| Field | Type | Required | Constraints | Description |
|---|---|---|---|---|
accessToken | string | yes | ||
refreshToken | string | yes | ||
expiresIn | integer | yes | Access token lifetime, in seconds. | |
usuario | Me | yes |
On error: ErroApi model.
Example
curl -X POST "$API/auth/primeiro-acesso/confirmar" -H "Content-Type: application/json" -d '{"email":"texto","codigo":"texto","senha":"texto"}'Reset the password with the emailed token
POST /auth/redefinir-senha
Access: Public (no sign-in). Rate limit: up to 10 calls every 60 s per origin. Success status: 204.
Request body (RedefinirSenhaInput)
| Field | Type | Required | Constraints | Description |
|---|---|---|---|---|
token | string | yes | 20–200 characters | |
senha | Senha | yes |
Response
No response body.
On error: ErroApi model.
Example
curl -X POST "$API/auth/redefinir-senha" -H "Content-Type: application/json" -d '{"token":"texto","senha":"texto"}'Exchange the refresh token for a new session
POST /auth/refresh
The refresh token is single use: reusing one that was already used ends all of the account's sessions. Always store the new pair returned.
Access: Public (no sign-in). Rate limit: up to 60 calls every 60 s per origin. Success status: 200.
Headers
| Parameter | Type | Required | Constraints | Description |
|---|---|---|---|---|
user-agent | string | no | Client application identification; stored for the connections list. |
Request body (RefreshInput)
| Field | Type | Required | Constraints | Description |
|---|---|---|---|---|
refreshToken | string | yes | 20–200 characters |
Response
| Field | Type | Required | Constraints | Description |
|---|---|---|---|---|
accessToken | string | yes | ||
refreshToken | string | yes | ||
expiresIn | integer | yes | Access token lifetime, in seconds. | |
usuario | Me | yes |
On error: ErroApi model.
Example
curl -X POST "$API/auth/refresh" -H "Content-Type: application/json" -d '{"refreshToken":"texto"}'Change your own password
POST /auth/trocar-senha
Access: Any signed-in person. Success status: 200.
Headers
| Parameter | Type | Required | Constraints | Description |
|---|---|---|---|---|
user-agent | string | no | Client application identification; stored for the connections list. |
Request body (TrocarSenhaInput)
| Field | Type | Required | Constraints | Description |
|---|---|---|---|---|
senhaAtual | Senha | yes | ||
novaSenha | Senha | yes |
Response
| Field | Type | Required | Constraints | Description |
|---|---|---|---|---|
accessToken | string | yes | ||
refreshToken | string | yes | ||
expiresIn | integer | yes | Access token lifetime, in seconds. | |
usuario | Me | yes |
On error: ErroApi model.
Example
curl -X POST "$API/auth/trocar-senha" -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{"senhaAtual":"texto","novaSenha":"texto"}'