REST API›Enterprise›User

POST

Login

Creates a short-lived (1 hour) access token for use with the API. Requires a verified email address. BitGo doesn't recommend using this endpoint for scripting. Instead, use the SDK or the web UI to create long-lived access tokens. However, short-lived access tokens are the only access tokens with the "user_manage" scope that enables you to programmatically add users to your enterprise using the Add User to Enterprise endpoint.

Body Params

object

  • email string email required
    The verified email address of the user
  • extensible boolean
    "true" if the session is extensible beyond a one-hour duration
  • otp string required
    Second factor authentication token.
  • password string required

Responses

200
OK

Response Body

object

  • access_token string
  • derivationPath string
  • encryptedECDHXprv string
  • encryptedToken string
  • expires_at number required
    Unix timestamp
  • expires_in number required
  • noECDHKeychain boolean
  • scope array of strings required
  • token_id string
    The public ID of the access token — used as the bearer token for v4 auth
  • token_type string required
  • grant_type string enum required
    Represents the login method that was used
    passwordpasskeyrefresh_tokenauthorization_codeoauth
  • user object required
    Fields that will always be populated in accordance with the defined codec If you find other fields that will provably always be populated on a given user (even for legacy users created long ago), that field can be moved to UserRequiredFields
    user object
    • agreements object required
      The agreements the user has accepted
      agreements object
      • patriotAct number required
      • termsOfUse number required
      • patriotActAcceptanceDate string date-time
      • termsOfUseAcceptanceDate string date-time
    • allowedCoins array of strings required
    • bitgoEmployee boolean required
      Whether the user is a BitGo employee
    • currency object required
      The user's preferred currency
      currency object
      • bitcoinUnit string required
      • currency string required
    • disableReset2FA boolean required
      Whether the user has disabled 2FA reset
    • organizations array of objects required
      organizations object
      • permissions array of string enums required
        admin
      • role string enum required
        serviceUseradminmembercustomer
      • id string
      • name string
    • featureFlags array of strings required
    • forceResetPassword boolean required
      Whether the user has forced a password reset
    • identity object required
      The user's identity information
      identity object
      • kyc object
        kyc object
        • available boolean required
        • required boolean required
        • data object
          data object
          • state string enum required
            unverifiedpendingapprovedrejectedqrscannedinreviewflaggedflagged_retry_allowed
          • fields map of objects nullable
            fields object
            • <key> object
        • documents object
          documents object
          • state string enum required
            unverifiedpendingapprovedrejectedqrscannedinreviewflaggedflagged_retry_allowed
        • failureCount number
        • fullyRequired boolean
        • hasVideoID boolean
        • overallState string enum
          unverifiedpendingapprovedrejectedqrscannedinreviewflaggedflagged_retry_allowed
        • passport object
          passport object
          • required boolean required
          • state string enum
            unverifiedpendingapprovedrejectedqrscannedinreviewflaggedflagged_retry_allowed
        • residency object
          residency object
          • state string enum required
            unverifiedpendingapprovedrejectedqrscannedinreviewflaggedflagged_retry_allowed
        • ongoingScreening object
          ongoingScreening object
          • state string enum required
            approvedrejected
        • isScreeningRequired boolean
        • documentsWaived boolean
        • unverifiedPaygoUser boolean
        • enterpriseVideoCallInfo array of objects
          enterpriseVideoCallInfo object
          • enterpriseId string required
          • videoCallId string required
        • enhancedVerificationLevel string enum
          L0L1L2L3
      • verified boolean
        Whether the user is verified
    • otpDevices array of objects required
      otpDevices object
      • createDate string date-time required
      • id string required
      • backupPhone string
      • label string
      • lastValidatedDate string date-time
      • phone string
      • registeredKey object
        registeredKey object
        • certificate string
        • keyHandle string
        • publicKey string
      • type string enum
        authytotpu2fwebauthnyubikey
      • verified boolean
      • scopes array of string enums
        wallet_hot
      • extensions map of booleans
        extensions object
        • <key> boolean
      • prfSalt string
      • isPasskey boolean
      • credentialId string
    • phone object required
      The user's phone number
      phone object
      • phone string nullable required
      • verified boolean required
    • timezone string required
      The user's timezone
    • apps object
      The apps the user has access to
    • country string
      The country of the user
    • ecdhKeychain string nullable
      The user's ECDH keychain
    • isActive boolean
      Whether the user is active
    • isFrozen boolean
      Whether the user is frozen
    • freezeReason string
      The reason the user is frozen if they are frozen
    • freeze object
      Freeze object that will hold the start time and expiration time of a user's freeze. By default the freeze is infinite, and this field will eventually override the isFrozen boolean field
      freeze object
      • time string date-time
      • expires string date-time
    • lastLogin string date-time
      The last login time of the user
    • locale string
      The user's locale
    • pgpKey string
      The user's PGP key
    • rateLimits object
      The rate limits applied to the user
    • referrer object
      The referrer of the user
      referrer object
      • campaign string nullable
      • source string nullable
    • signupDomain string
      The signup domain of the user
    • state string
      The state of the user
    • sourceVerificationRequired boolean
      Whether source verification is required for the user
    • sourceVerificationRequiredForReadOnlyAccess boolean
      Whether source verification is required for read-only access
    • recoveryCodeSet object
      The recovery code set for the user
      recoveryCodeSet object
      • id string required
        The ID of the recovery code set
      • allCodesUsed boolean required
        Whether all recovery codes have been used
    • createTime string
    • passwordUpdatedAt string date-time
    • id string required
      The unique identifier for the user

      matches ^[0-9a-f]{32}$

    • username string email required
      The username of the user
    • name object required
      The name of the user
      name object
      • first string required
      • full string required
      • last string required
    • enterprises array of objects required
      enterprises object
      • permissions array of string enums required
        adminauditorwallet.create
      • id string
      • beneficialOwner boolean
      • primaryContact string
      • kycState string enum
        unverifiedapprovedrejectedpendingqrscannedinreviewflaggedflagged_retry_allowed
      • bitgoOrg string
      • name string
      • videoIdState string
      • videoIdLink string
    • email object required
      The email address of the user
      email object
      • email string email required
      • verified boolean required
  • warning string
  • sourceVerificationType string
    How the request source was verified during login.
  • twoFactorMethod string
    The two-factor authentication method used during login.
  • ssoProvider string
    The SSO provider used for login, when applicable.
400
Bad Request

Response Body

object

  • name string
    Error code
  • context map of objects required
    Properties that apply to a specific error name
    context object
    • <key> object
  • error string required
    Human-readable error message
  • requestId string required
    Client request id
401
Unauthorized

Response Body

object

  • name string
    Error code
  • context map of objects required
    Properties that apply to a specific error name
    context object
    • <key> object
  • error string required
    Human-readable error message
  • requestId string required
    Client request id