Sign in with a local account
POST/api/auth/breakglass
Exchange an email and password for a session. This is the only sign-in that works without a browser, so it is the way a script or service obtains a token for this API. Browser single sign-on (Microsoft Entra ID) is separate.
The access token lasts 1 hour and the refresh token 14 days. Send the access token as Authorization: Bearer <token> on every other call.
If the same email and password match accounts in more than one tenant, the call fails with 401 rather than guessing.
Treat these credentials as secrets: use a dedicated account with the narrowest role that works.
Request
Responses
- 200
- 401
- 422
A token pair.
The email or password is wrong, the account is disabled, or the credentials match more than one tenant.
Validation Error