Login Process Flow

Following are the service’s endpoints for login process

1. Authorize API

Endpoint

POST /api/v1/authorize

Description

Validates client credentials using a token provided in the header.

Workflow

1. Call the API to validate the client using the deviceIdentity token in the header.

2. Decision: Is the token valid?

   1. Yes: Return a loginChallenge and authToken.

   2. No: Throw an error.

---

authorize

post

Header parameters

AuthorizationstringRequired

Access Token

locLatitudestringOptional

Latitude location

locLongitudestringOptional

Longitude location

Body

application/json

authTokenstringOptional

clientIdstringOptional

codeChallengestringOptional

codeChallengeMethodstringOptional

loginVerifierstringOptional

scopestringOptional

statestringOptional

Responses

200

Success|Ok

*/*

201

Created

400

Bad Request

401

Unauthorized

403

Forbidden

404

Not Found

500

Internal Server Error

502

Bad Gateway

503

Service Unavailable

post

/ciamauthsrvc/internetBanking/oauth/authorize

HTTPcURLJavaScriptPython

POST /ciamauthsrvc/internetBanking/oauth/authorize HTTP/1.1
Host: x.x.cymmetri.in
Authorization: text
Content-Type: application/json
Accept: */*
Content-Length: 143

{
  "authToken": "text",
  "clientId": "text",
  "codeChallenge": "text",
  "codeChallengeMethod": "text",
  "loginVerifier": "text",
  "scope": "text",
  "state": "text"
}

{
  "data": {},
  "errorCode": "String",
  "errorMeta": "String",
  "message": "String",
  "success": false,
  "timestamp": "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"
}

2. Generate Captcha API

Endpoint

GET /api/v1/captcha

Description

Generates a new captcha if no valid captcha exists or replaces the current captcha.

Workflow

1. Call the API to generate a captcha with checkIdentity in the header.

2. Decision: Is there a previously existing captcha?

• Yes: Remove the existing captcha and generate an encoded captcha.

• No: Throw an error.

---

3. Login Challenge API

Endpoint

POST /api/v1/login-challenge

Description

Validates user credentials and performs additional checks like captcha verification.

Workflow

1. Call the API to validate the user credentials.

2. Decision: Is the captcha valid?

3. • Yes: Continue.

   • No: Throw an error.

4. Decision: Are the credentials valid?

5. • Yes: Continue.

   • No: Throw an error.

6. Decision: Is an anomaly detected?

7. • Yes: Initiate 2FA (Two-Factor Authentication).

   • No: Return a token and code.

---

acceptLoginChallenge

post

Header parameters

AuthorizationstringRequired

Access Token

eventIdstringOptional

event Id

locLatitudestringOptional

Latitude location

locLongitudestringOptional

Longitude location

Body

application/json

additionalAuthenticationstring · enumOptionalPossible values:

authTokenstringRequired

Encrypted String

Example: sfgjhgsf3hddfqwqesg3435qfa

loginChallengestringRequired

String

Example: hgsadfhj835gsdf7.nfh7867438fg7

Responses

200

Success|Ok

*/*

201

Created

400

Bad Request

401

Unauthorized

403

Forbidden

404

Not Found

500

Internal Server Error

502

Bad Gateway

503

Service Unavailable

post

/ciamauthsrvc/internetBanking/oauth/acceptLoginChallenge

HTTPcURLJavaScriptPython

POST /ciamauthsrvc/internetBanking/oauth/acceptLoginChallenge HTTP/1.1
Host: x.x.cymmetri.in
Authorization: text
Content-Type: application/json
Accept: */*
Content-Length: 629

{
  "additionalAuthentication": "CONSENT_CODE",
  "authToken": "sfgjhgsf3hddfqwqesg3435qfa",
  "efrms": {
    "EventSubType": "text",
    "EventType": "text",
    "event_name": "text",
    "msgBody": {
      "addr_network": "text",
      "app_id": "text",
      "cust_id": "text",
      "device_id": "text",
      "device_type": "text",
      "error_code": "text",
      "error_desc": "text",
      "event_id": "text",
      "eventts": "text",
      "host_id": "text",
      "last_login_ip": "text",
      "last_login_ts": "text",
      "login_ts": "text",
      "reservedfield1": "text",
      "reservedfield2": "text",
      "reservedfield3": "text",
      "source": "text",
      "sys_time": "text",
      "time_slot": "text",
      "tran_date": "text",
      "user_id": "text"
    }
  },
  "loginChallenge": "hgsadfhj835gsdf7.nfh7867438fg7"
}

{
  "data": {},
  "errorCode": "String",
  "errorMeta": "String",
  "message": "String",
  "success": false,
  "timestamp": "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"
}

4. Pre-Login Verify API

Endpoint

POST /api/v1/pre-login-verify

Description

Validates the OTP (One-Time Password) provided by the user.

Workflow

1. Call the API to validate the OTP.

2. Decision: Is the OTP valid?

3. • Yes: Generate and return a token.

   • No: Throw an error.

---

mfa email otp resend

post

Header parameters

AuthorizationstringRequired

Access Token

eventIdstringOptional

event Id

locLatitudestringOptional

Latitude location

locLongitudestringOptional

Longitude location

Body

application/json

consentOtpstringRequired

mfaChallengestringRequired

Responses

200

Success|Ok

*/*

201

Created

400

Bad Request

401

Unauthorized

403

Forbidden

404

Not Found

502

Bad Gateway

503

Service Unavailable

post

/ciamauthsrvc/auth/mfa/prelogin/verify

HTTPcURLJavaScriptPython

POST /ciamauthsrvc/auth/mfa/prelogin/verify HTTP/1.1
Host: x.x.cymmetri.in
Authorization: text
Content-Type: application/json
Accept: */*
Content-Length: 538

{
  "consentOtp": "text",
  "efrms": {
    "EventSubType": "text",
    "EventType": "text",
    "event_name": "text",
    "msgBody": {
      "addr_network": "text",
      "app_id": "text",
      "cust_id": "text",
      "device_id": "text",
      "device_type": "text",
      "error_code": "text",
      "error_desc": "text",
      "event_id": "text",
      "eventts": "text",
      "host_id": "text",
      "last_login_ip": "text",
      "last_login_ts": "text",
      "login_ts": "text",
      "reservedfield1": "text",
      "reservedfield2": "text",
      "reservedfield3": "text",
      "source": "text",
      "sys_time": "text",
      "time_slot": "text",
      "tran_date": "text",
      "user_id": "text"
    }
  },
  "mfaChallenge": "text"
}

{
  "data": {},
  "errorCode": "String",
  "errorMeta": "String",
  "message": "String",
  "success": false,
  "timestamp": "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"
}

5. Access Token API

Endpoint

POST /api/v1/access-token

Description

Generates an access and refresh token after validating user credentials.

Workflow

1. Call the API to validate user credentials.

2. Decision: Does the session exist?

3. • Yes: Proceed.

   • No: Throw an error.

4. Decision: Are the token details valid?

5. • Yes: Save the session.

   • No: Throw an error.

6. Decision: Is the session saved successfully?

7. • Yes: Generate access and refresh tokens.

   • No: Throw an error.

---

accessToken

post

Header parameters

AuthorizationstringRequired

Access Token

eventIdstringOptional

event Id

locLatitudestringOptional

Latitude location

locLongitudestringOptional

Longitude location

Body

application/json

clientIdstringOptional

codestringOptional

codeVerifierstringOptional

grantTypestringOptional

redirectUristringOptional

scopestringOptional

statestringOptional

Responses

200

Success|Ok

*/*

201

Created

400

Bad Request

401

Unauthorized

403

Forbidden

404

Not Found

500

Internal Server Error

502

Bad Gateway

503

Service Unavailable

post

/ciamauthsrvc/internetBanking/oauth/accessToken

HTTPcURLJavaScriptPython

POST /ciamauthsrvc/internetBanking/oauth/accessToken HTTP/1.1
Host: x.x.cymmetri.in
Authorization: text
Content-Type: application/json
Accept: */*
Content-Length: 620

{
  "clientId": "text",
  "code": "text",
  "codeVerifier": "text",
  "efrms": {
    "EventSubType": "text",
    "EventType": "text",
    "event_name": "text",
    "msgBody": {
      "addr_network": "text",
      "app_id": "text",
      "cust_id": "text",
      "device_id": "text",
      "device_type": "text",
      "error_code": "text",
      "error_desc": "text",
      "event_id": "text",
      "eventts": "text",
      "host_id": "text",
      "last_login_ip": "text",
      "last_login_ts": "text",
      "login_ts": "text",
      "reservedfield1": "text",
      "reservedfield2": "text",
      "reservedfield3": "text",
      "source": "text",
      "sys_time": "text",
      "time_slot": "text",
      "tran_date": "text",
      "user_id": "text"
    }
  },
  "grantType": "text",
  "redirectUri": "text",
  "scope": "text",
  "state": "text"
}

{
  "data": {},
  "errorCode": "String",
  "errorMeta": "String",
  "message": "String",
  "success": false,
  "timestamp": "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"
}

6. Revoke Token API

Endpoint

POST /api/v1/revoke-token

Description

Revokes an existing access and refresh token using the sessionId.

Workflow

1. Call the API to revoke access and refresh tokens.

2. Decision: Does the session exist?

3. • Yes: Continue.

   • No: Throw an error.

4. Decision: Is the session removed successfully?

5. • Yes: Return a success response.

   • No: Throw an error.

---

revoke access token

post

Header parameters

AuthorizationstringRequired

Access Token

locLatitudestringOptional

Latitude location

locLongitudestringOptional

Longitude location

Body

application/json

clientIdstringOptional

Responses

200

Success|Ok

*/*

201

Created

400

Bad Request

401

Unauthorized

403

Forbidden

404

Not Found

500

Internal Server Error

502

Bad Gateway

503

Service Unavailable

post

/ciamauthsrvc/internetBanking/oauth/revoke

HTTPcURLJavaScriptPython

POST /ciamauthsrvc/internetBanking/oauth/revoke HTTP/1.1
Host: x.x.cymmetri.in
Authorization: text
Content-Type: application/json
Accept: */*
Content-Length: 19

{
  "clientId": "text"
}

{
  "data": {},
  "errorCode": "String",
  "errorMeta": "String",
  "message": "String",
  "success": false,
  "timestamp": "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"
}

7. Refresh Token API

Endpoint

POST /api/v1/refresh-token

Description

Renews the access and refresh tokens for an existing session.

Workflow

1. Call the API to renew the tokens.

2. Decision: Does the session exist?

3. • Yes: Proceed.

   • No: Throw an error.

4. Decision: Is the session valid?

5. • Yes: Renew and return the access and refresh tokens.

   • No: Throw an error.

---

get access token from Refresh token for Ib

post

Header parameters

locLatitudestringOptional

Latitude location

locLongitudestringOptional

Longitude location

Body

application/json

clientIdstringOptional

codestringOptional

codeVerifierstringOptional

grantTypestringOptional

loginstringOptional

redirectUristringOptional

refreshTokenstringOptional

scopestringOptional

statestringOptional

Responses

200

Success|Ok

*/*

201

Created

400

Bad Request

401

Unauthorized

403

Forbidden

404

Not Found

500

Internal Server Error

502

Bad Gateway

503

Service Unavailable

post

/ciamauthsrvc/internetBanking/oauth/accessToken/refresh

HTTPcURLJavaScriptPython

POST /ciamauthsrvc/internetBanking/oauth/accessToken/refresh HTTP/1.1
Host: x.x.cymmetri.in
Content-Type: application/json
Accept: */*
Content-Length: 162

{
  "clientId": "text",
  "code": "text",
  "codeVerifier": "text",
  "grantType": "text",
  "login": "text",
  "redirectUri": "text",
  "refreshToken": "text",
  "scope": "text",
  "state": "text"
}

{
  "data": {},
  "errorCode": "String",
  "errorMeta": "String",
  "message": "String",
  "success": false,
  "timestamp": "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"
}