API reference / Accounts

post/v2/accounts/sign-in

Sign in to the applicant wizard

Operation
signInAccount
Authentication
None — public

The password grant of `POST /v1/token`, ending in an `HttpOnly` cookie instead of tokens in the body — the browser never holds a credential a script can read. Requires a confirmed address (an unconfirmed account answers 409) because the session is what scopes the wizard to the applicant’s own applications, and confirming is what attaches the application they started before they signed up. An account with two-factor authentication is refused: no second-factor step exists on this surface yet.

Request

Body

emailstringrequired
passwordstringrequired

Responses

200Signed in. The session is in the cookie, not the body.
userAccountUserrequired
linked_applicationsobject[]required
400The request body or query failed validation.
errorobjectrequired
401Email or password is incorrect.
errorobjectrequired
403The account has two-factor authentication enabled.
errorobjectrequired
409The email address has not been confirmed.
errorobjectrequired
429Too many requests.
errorobjectrequired

Example

curl
curl -X POST https://api.haavisa.com/v2/accounts/sign-in \
  -H "Content-Type: application/json" \
  -d '{
    "email": "<email>",
    "password": "<password>"
  }'

More in Accounts

Something unclear? The eligibility guide explains the model behind the answers; the errors guide covers the envelope.