AuthWithCodeRequestDto

The same credentials as an ordinary sign-in, plus the one-time code that completes it.

Name	Type	Description	Notes
userName	String	The account signing in, given as its email address or its portal user name. It is required for a password sign-in and ignored when the credentials are a confirmation key or a third-party account.	[optional]
password	String	The password in the clear. Send either this or passwordHash, never both; hashing it in the client with the parameters from GET api/2.0/settings?withpassword=true and sending passwordHash instead keeps the plain password off the wire.	[optional]
passwordHash	String	The password already hashed in the client. It has to be produced with the salt, iteration count and hash size that GET api/2.0/settings?withpassword=true publishes, or the portal cannot recognise it; a value sent here takes the place of password.	[optional]
provider	String	The third-party identity provider the account is being signed in through, by its internal key such as google or linkedin. Sending it switches the call to a third-party sign-in, which needs accessToken or serializedProfile and is only allowed on a self-hosted installation or a tariff that includes third-party sign-in.	[optional]
accessToken	String	The access token the provider named in provider issued for the account, passed on unchanged for the portal to verify with that provider. The portal then matches the address it gets back against its own accounts, so a valid token for an address unknown here is answered as no such user.	[optional]
serializedProfile	String	The third-party profile already fetched and serialised by the caller, as an alternative to accessToken for a provider whose profile the client holds. It identifies the account by the address it carries.	[optional]
codeOAuth	String	The OAuth authorization code obtained from the provider, for a flow that has not been exchanged for an access token yet. It is recorded with the sign-in rather than replacing accessToken.	[optional]
session	Boolean	Whether the issued token is tied to the browser session. When it is, the answer carries no expires and the token dies with the session; otherwise it lives for the portal session lifetime.	[optional]
confirmData	ConfirmData	The confirmation link data, as a third way to identify the account beside a password and a third-party account. Send it when the sign-in comes from a link the portal mailed, in which case userName and the password fields are not read.	[optional]
recaptchaType	RecaptchaType	Which CAPTCHA service the proof in recaptchaResponse came from. It has to match the service the installation is configured with, which GET api/2.0/settings publishes together with the site key.	[optional] [enum: 0, 1, 2, 3]
recaptchaResponse	String	The token the CAPTCHA widget produced in the browser, passed on unchanged for the portal to verify. It is only demanded once repeated failures have made the portal ask for a challenge, and it is single-use, so a retry needs a freshly solved one.	[optional]
culture	String	The language the sign-in messages and any letter that follows are written in, as a culture name such as en-US. A culture the installation does not have falls back to the portal language.	[optional]
code	String	The one-time code from the SMS the portal sent or from the authenticator app, whichever second factor the portal has enabled for this user. It is single-use and expires; a wrong, empty or expired value fails the sign-in and counts against the brute-force limit.	[optional] [nullable]