# User Login
## Endpoint
`/api/user/login`
**Obsolete Path:** `/api/login`
## Method
GET
## Description
Authenticates with the server and generates a session token to be used for subsequent API calls. The session token expires as per the user's session expiry timeout value (default 30 minutes) from the last API call.
## Parameters
| `user` | string | Yes | - | The username for the user account. The built-in administrator username is `admin`. |
| `pass` | string | Yes | - | The password for the user account. The default password for `admin` user is `admin`. |
| `totp` | string | No | Required if the user account has Two Factor Authentication (2FA) enabled | The time-based one-time password (6-digit code from authenticator app). |
| `includeInfo` | boolean | No | - | When `true`, includes basic info relevant for the user in the response (version, dnsServerDomain, defaultRecordTtl, defaultNsRecordTtl, defaultSoaRecordTtl, permissions). |
## Authentication
No token required. This endpoint is used to obtain a token.
## Response Fields
| `displayName` | string | The display name of the user account. |
| `username` | string | The username of the authenticated user. |
| `totpEnabled` | boolean | Whether 2FA is enabled on this account. |
| `token` | string | The session token that MUST be used with all subsequent API calls. |
| `info` | object | (Only present when `includeInfo=true`) Contains server info and permissions. |
| `info.version` | string | DNS server software version. |
| `info.dnsServerDomain` | string | The DNS server domain name. |
| `info.defaultRecordTtl` | integer | Default TTL for DNS records. |
| `info.defaultNsRecordTtl` | integer | Default TTL for NS records. |
| `info.defaultSoaRecordTtl` | integer | Default TTL for SOA records. |
| `info.permissions` | object | Map of permission sections (Dashboard, Zones, Cache, Allowed, Blocked, Apps, DnsClient, Settings, DhcpServer, Administration, Logs) each with `canView`, `canModify`, `canDelete` booleans. |
## Conditional Logic Notes
- If the user account has 2FA enabled and the `totp` parameter is not provided (or is incorrect), the login will fail.
- The `includeInfo` parameter controls whether the `info` object is included in the response; when omitted or `false`, the `info` field is absent.
- The default `admin` password is `admin` -- the API docs strongly recommend changing it on first use.
## Edge Cases
- The default `admin`/`admin` credentials are a security risk; the docs include a warning to change them immediately.
- The session token has a sliding expiration window (default 30 minutes from the last API call), not a fixed expiration from login time.
- The obsolete path `/api/login` is still supported but deprecated.