---
title: "Gets a JWT token."
method: POST
path: "/rest/login/getjwttoken"
tags: ["Login APIs"]
---

# Gets a JWT token.

`POST /rest/login/getjwttoken`

## Request

- Base URL: `https://masonconsole.com`
- URL: `https://masonconsole.com/rest/login/getjwttoken`
- Auth: HTTP bearer

This endpoint allows users to obtain a JWT token (short expiration) and a refresh token (long expiration) for authentication of further API calls. It takes a JSON object containing the username and password (required fields) in the request body. The method performs authentication, generates tokens, and handles various authentication exceptions

## Request body

- LoginRequest
  - `username` string, required: Username of the user
  - `password` string, required: Password of the user
  - `totpcode` string: TOTP code (Time-Based One-Time Password) for two-factor authentication
  - `idToken` string: ID token
  - `ssoDomain` string: SSO (Single Sign-On) domain
  - `refreshToken` string: Refresh token used for token renewal

## Response `200`

Successful response

- LoginResponse
  - `data` LoginData: The data returned in the response.
    - `token` string: Token used for further requests from the server.
    - `refreshToken` string: Token used to receive a new token.
    - `allClaimsFromToken` ClaimsFromLoginToken: Info about the token.
      - `sub` string: Token owner's username.
      - `s` integer: JWT secret creation time.
      - `ac` integer: Encoded value of the Access Control List (ACL) level set for the user. It is only presented if at least one permission was removed from the user.
      - `tags` string[]: Authorization tags set for the user.
      - `usertype` string: The type of user related to the token. For the MDM application, the user type will be GEO_USER_MDM.
      - `exp` integer: Expiration for the token.
      - `iat` integer: Time at which the token was initiated at
      - `authorities` string[]: Token owner's authorities.
  - `result` string: The result of the login operation. Should be either 'SUCCESS' or 'FAILURE'.
  - `message` string: The message associated with the login response (applicable in case of 'FAILURE').
  - `@class` string, required

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `429`: Too Many Requests
- `500`: Internal server error
- `503`: Service Unavailable

---

[API](https://skmtc.dev/bymason/apis/mason-device-console-api-docs.md) - [All operations](https://skmtc.dev/bymason/apis/mason-device-console-api-docs/llms.txt) - [OpenAPI document](https://skmtc.dev/bymason/apis/mason-device-console-api-docs/revisions/d9cdcc14b7d1?raw)