---
title: "Hs Login"
method: POST
path: "/api/asclepius/hs/login"
tags: ["asclepius-provider"]
---

# Hs Login

`POST /api/asclepius/hs/login`

## Request

- Base URL: `https://app.archangelhealth.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://app.archangelhealth.ai/api/asclepius/hs/login`
- Auth: none declared

Sign in with the emailed username + password.

ONE code path for existing and non-existing usernames. Every observable —
status code, message, Retry-After, and the progressive delay — is produced
by the same statements regardless of whether the account is real, so the
response cannot be used to enumerate which hospitals are partners. Usernames
here are derived deterministically from the organization name, which is what
made the old 5th-attempt 429/401 split a partnership-disclosure leak.

The hard lock is scoped to (username, ip): five wrong guesses stop THAT
caller, not the hospital. A username-only lock let anyone who could guess
`massgeneral` hold Mass General out of its own portal indefinitely.

## Request body

- HsLoginRequest
  - `username` string, required
  - `password` string, required

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/archangelhealth/apis/archangel-health-surgical-patient-platform.md) - [All operations](https://skmtc.dev/archangelhealth/apis/archangel-health-surgical-patient-platform/llms.txt) - [OpenAPI document](https://skmtc.dev/archangelhealth/apis/archangel-health-surgical-patient-platform/revisions/3514f4e119da?raw)