Sign in to the firm's practice system with your own account (any role)

For a firm whose practice system each member signs in to (tenant.connector.identity is sign_in on GET /v1/me): the caller's own username and password there, and the six-digit code on the second press of an account that has two-factor on; or, in their place, api_token, a token the caller made in the system, which is how a person who signs in there with Microsoft connects. A token the system refuses is step.login with reason token. Which system and which installation are the firm's, read from its own row: a posted host or kind is a 400. The sign-in is VERIFIED before anything is stored, and a failure is the connect route's 422, one error whose path names the step (step.login, step.tls, step.rights); step.login with reason code asks for the code where none was sent and refuses the one that was. On success the session the system handed back is sealed under the firm's key as the caller's own (never the password or the code), the caller is bound to that account of the system, and the answer is their link as GET /v1/me then carries it in member.system_link. It answers as soon as the system accepted the sign-in and runs NO sync: the link's synced is false until the caller's first read has finished, which the client starts itself, straight after, with POST /v1/connector/account/sync. An account another member of the firm already signed in with is a 409 and writes nothing: the first sign-in holds it. While the FIRM's own link is not connected the answer is a 409 of the type urn:six-minute:problem:connector-not-connected, before anything is dialled: nothing the caller typed is wrong, and an administrator connects the firm first. An account that books no time there is accepted; its releases are refused as connector.timekeeper. Signing in again replaces the session. 404 while the firm has no connector, or one the firm connected once. A firm that is connected is one every member can sign in at.