Authentication and authorization

Get token (POST /login)

Every endpoint requires a JWT token, except POST /login and GET /health.

Endpoint: POST /login

Body:

{
  "username": "user",
  "password": "password"
}

Successful response (200):

{
  "access": true,
  "access_token": "<valid token>"
}

The response does not expose internal fields such as Name, User, UserId, ClientId, Roles or Campaigns.

Code	Case
`400`	Malformed body (cannot be parsed as JSON)
`401`	Invalid credentials (no response body)

Add the token to every request:

Authorization: Bearer <access_token>

The BSP_CN permission allows the token to operate on clients other than its own through the client_id parameter.

With BSP_CN: the token can operate on any client by passing its client_id. On endpoints that require it, omitting it returns 400.
Without BSP_CN: operations are limited to the token’s own client: sending another client’s client_id returns 403, and listings only expose data within the token’s scope (for example, templates assigned to its campaigns; if it has none, the listing returns 400 agent without campaigns).

Each endpoint page documents the specific behavior of client_id.