Authentication

Login uses your email address and password. Username login is still accepted for accounts that predate email login, but email is the primary identifier.

Password login

POST /api/v1/auth/login expects an OAuth2 form (form-encoded):

curl -X POST https://api.xlnszia.com/api/v1/auth/login \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "username=you@example.com&password=secret"

Returns:

{ "access_token": "...", "token_type": "bearer" }

Send the token on every request:

curl https://api.xlnszia.com/api/v1/tests \
  -H "Authorization: Bearer <access_token>"

Personal access tokens

Create a Personal Access Token (PAT) in the UI at Settings → Governance → API Tokens (name, expiry, scope permissions) and use it with the same Authorization: Bearer <token> header. A PAT can only call the resources covered by its scopes.

SSO (SAML / Microsoft Entra)

• ACS / Reply URL: https://api.xlnszia.com/api/v1/auth/sso/acs
• Sign-on URL: https://api.xlnszia.com/api/v1/auth/sso/login
• SP Entity ID: xlnszia
• NameID: email

When SSO is configured and enabled, the login page shows Sign in with Microsoft Entra; after a successful login you are redirected back to https://app.xlnszia.com/login?sso_token=....

Account security

• Change your password under Profile → Change password.
• Change the default admin password (admin@example.com / admin123) immediately after first login.