Auth API

Base route: /api/auth
Auth required: ❌ Public

---

POST /api/auth/login

Authenticates a user and returns a signed JWT.

The returned token encodes the user's resolved permissions as perm claims in the format Collection:Action.
Admin users receive is_admin: "true" which bypasses all subsequent permission checks.

Request Body

{
  "email": "admin@medregia.com",
  "password": "your-password"
}

Field	Type	Required	Description
email	string	✅	User's email address
password	string	✅	Plain text password (transmitted over HTTPS)

Response 200 OK

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expiresAt": "2026-03-18T10:00:00Z",
  "user": {
    "id": 1,
    "firstName": "Admin",
    "lastName": "User",
    "email": "admin@medregia.com",
    "roleId": 1,
    "isActive": true
  }
}

Response 401 Unauthorized

{ "message": "Invalid email or password." }

Using the Token

Include the token in all subsequent requests:

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

Tokens expire after 24 hours (configurable via Jwt:ExpirationHours).