JWT Login

1 min

POST

{{url}}/aioc-rest-web/rest/jwt/login

Token-based login for scripts, integrations, and third-party connectors (e.g. SIEM/SOAR/discovery tools) that need to call the KRON PAM REST API without a browser-style session/cookie flow. Prefer this endpoint over the legacy POST /rest/login for any non-interactive/automated client.

Request Headers:

Content-Type: application/json

Successful Response (200):

{
    "token_type": "bearer",
    "access_token": "<jwt-access-token>",
    "refresh_token": "<jwt-refresh-token>"
}

Usage:
Send the returned access_token as a Bearer token on every subsequent request:

Authorization: Bearer <access_token>

No session cookie or X-XSRF-TOKEN header is required for JWT-authenticated calls.

Invalid credentials / brute-force protection:
After repeated invalid attempts from the same client IP, the endpoint returns 429 Too Many Requests with {"error":"too_many_requests"} for a short cooldown window, then automatically allows login attempts again once the window expires. This differs from the CAPTCHA-based lockout on the legacy login flow, which a non-interactive client cannot solve — this is why scripted/automated clients should authenticate via this JWT endpoint instead of POST /rest/login.

Path Parameters

urlstring
Default
url

Header Parameters

Content-Typestring
Default
application/json

Body Parameters

bodyobject
Default
{"username":"{{TestUserName}}","password":"{{TestUserPassword}}"}

Responses

200

JWT Login - Success

429

JWT Login - Too Many Requests

curl

curl --request POST \
     --url {{url}}/aioc-rest-web/rest/jwt/login \
     --header 'accept: application/json' \
     --header 'content-type: application/json' \
     --data '"{\"username\":\"{{TestUserName}}\",\"password\":\"{{TestUserPassword}}\"}"'

javascript

var myHeaders = new Headers();
myHeaders.append("accept", "application/json");
myHeaders.append("content-type", "application/json");

var raw = JSON.stringify("{\"username\":\"{{TestUserName}}\",\"password\":\"{{TestUserPassword}}\"}");

var requestOptions = {
   method: 'POST',
   headers: myHeaders,
   body: raw,
   redirect: 'follow'
};

fetch("{{url}}/aioc-rest-web/rest/jwt/login", requestOptions)
   .then(response => response.text())
   .then(result => console.log(result))
   .catch(error => console.log('error', error));

ruby

require "uri"
require "json"
require "net/http"

url = URI("{{url}}/aioc-rest-web/rest/jwt/login")

http = Net::HTTP.new(url.host, url.port);
request = Net::HTTP::Post.new(url)
request["accept"] = "application/json"
request["content-type"] = "application/json"
request.body = JSON.dump("{\"username\":\"{{TestUserName}}\",\"password\":\"{{TestUserPassword}}\"}")

response = http.request(request)
puts response.read_body

python

import requests
import json

url = "{{url}}/aioc-rest-web/rest/jwt/login"

payload = json.dumps("{\"username\":\"{{TestUserName}}\",\"password\":\"{{TestUserPassword}}\"}")
headers = {
   'accept': 'application/json',
   'content-type': 'application/json'
}

response = requests.request("POST", url, headers=headers, data=payload)

print(response.text)

200

{
    "token_type": "bearer",
    "access_token": "<jwt-access-token>",
    "refresh_token": "<jwt-refresh-token>"
}

429

{
    "error": "too_many_requests",
    "error_description": "Too many requests from the same client IP"
}