Login

curl --request POST \
  --url https://api.example.com/api/auth/login \
  --header 'Content-Type: application/json' \
  --data '
{
  "email": "<string>",
  "password": "<string>"
}
'

import requests

url = "https://api.example.com/api/auth/login"

payload = {
    "email": "<string>",
    "password": "<string>"
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({email: '<string>', password: '<string>'})
};

fetch('https://api.example.com/api/auth/login', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/api/auth/login",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'email' => '<string>',
    'password' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/api/auth/login"

	payload := strings.NewReader("{\n  \"email\": \"<string>\",\n  \"password\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.example.com/api/auth/login")
  .header("Content-Type", "application/json")
  .body("{\n  \"email\": \"<string>\",\n  \"password\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.example.com/api/auth/login")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"email\": \"<string>\",\n  \"password\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "400": {},
  "401": {},
  "500": {},
  "success": true,
  "message": "<string>",
  "token": "<string>",
  "user": {
    "id": "<string>",
    "email": "<string>",
    "full_name": "<string>",
    "role": "<string>",
    "is_email_verified": true,
    "seller_profile": {
      "identity_document": "<string>",
      "selfie_url": "<string>",
      "verification_status": "<string>",
      "verification_method": "<string>",
      "verified_at": "<string>",
      "is_verified_badge": true
    }
  }
}

POST

api

auth

curl --request POST \
  --url https://api.example.com/api/auth/login \
  --header 'Content-Type: application/json' \
  --data '
{
  "email": "<string>",
  "password": "<string>"
}
'

import requests

url = "https://api.example.com/api/auth/login"

payload = {
    "email": "<string>",
    "password": "<string>"
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({email: '<string>', password: '<string>'})
};

fetch('https://api.example.com/api/auth/login', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/api/auth/login",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'email' => '<string>',
    'password' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/api/auth/login"

	payload := strings.NewReader("{\n  \"email\": \"<string>\",\n  \"password\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.example.com/api/auth/login")
  .header("Content-Type", "application/json")
  .body("{\n  \"email\": \"<string>\",\n  \"password\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.example.com/api/auth/login")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"email\": \"<string>\",\n  \"password\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "400": {},
  "401": {},
  "500": {},
  "success": true,
  "message": "<string>",
  "token": "<string>",
  "user": {
    "id": "<string>",
    "email": "<string>",
    "full_name": "<string>",
    "role": "<string>",
    "is_email_verified": true,
    "seller_profile": {
      "identity_document": "<string>",
      "selfie_url": "<string>",
      "verification_status": "<string>",
      "verification_method": "<string>",
      "verified_at": "<string>",
      "is_verified_badge": true
    }
  }
}

Endpoint

POST /api/auth/login

Authentication

No authentication required.

Request Body

string

required

User’s email address. Must be a valid email format.

string

required

User’s password.

Response

boolean

Indicates whether the login was successful.

string

Human-readable message describing the result.

string

JWT authentication token. Expires in 7 days by default.

object

User information including profile details.

string

User’s unique identifier.

string

User’s email address.

string

User’s full name.

string

User’s role (“seller” or “admin”).

boolean

Whether the user’s email has been verified.

object

Seller-specific profile information. Null for admin users.

string

URL or identifier for the seller’s identity document.

string

URL to the seller’s selfie image.

string

Verification status: “pending”, “verified”, or “rejected”.

string

Method used for verification: “manual” or “automatic”.

string

ISO 8601 timestamp of when verification was completed.

boolean

Whether the seller has a verified badge displayed.

Example Request

curl -X POST https://api.horsetrust.com/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "seller@example.com",
    "password": "securePassword123"
  }'

const response = await fetch('https://api.horsetrust.com/api/auth/login', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    email: 'seller@example.com',
    password: 'securePassword123'
  })
});

const data = await response.json();

// Store the token for future requests
if (data.success) {
  localStorage.setItem('authToken', data.token);
}

Example Response

200 Success

{
  "success": true,
  "message": "Login successful",
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "user": {
    "id": "507f1f77bcf86cd799439011",
    "email": "seller@example.com",
    "full_name": "John Smith",
    "role": "seller",
    "is_email_verified": false,
    "seller_profile": {
      "verification_status": "pending",
      "is_verified_badge": false
    }
  }
}

Error Responses

error

Bad Request - Validation error.

{
  "success": false,
  "message": "Valid email required"
}

error

Unauthorized - Invalid credentials or inactive account.

{
  "success": false,
  "message": "Invalid credentials"
}

error

Server Error - Internal server error.

{
  "success": false,
  "message": "Server error"
}

Notes

Email is normalized and converted to lowercase before authentication
Only active users (is_active: true) can log in
The last_login timestamp is automatically updated upon successful login
Password comparison is done securely using bcrypt
The JWT token contains the user’s ID and role, and should be included in the Authorization header for protected endpoints
Store the token securely (e.g., httpOnly cookies or secure storage) and never expose it in URLs or logs

Get Current User

⌘I

Authentication

Horses

Chat

Admin

Endpoint

Authentication

Request Body

Response

Example Request

Example Response

Error Responses

Notes

​Endpoint

​Authentication

​Request Body

​Response

​Example Request

​Example Response

​Error Responses

​Notes

Endpoint

Authentication

Request Body

Response

Example Request

Example Response

Error Responses

Notes