Company access / API reference

Start Company Login

Request and response reference for POST /api/auth/company/{slug}/start.

POST/api/auth/company/{slug}/start

Authentication: Unauthenticated

Use the base URL and access configuration provided to your institution. Examples are request templates, not transaction results. Field tables focus on client fields; preserve additional metadata returned by the configured service.

Request

This entry point does not require an existing session. Applicable onboarding, origin and verification policies still apply.

Request templatecURL

curl -X POST "$OSAI_CONSOLE_BASE_URL/api/auth/company/$SLUG_ID/start" \
  -H "Content-Type: application/json" \
  -H "Origin: $OSAI_APP_ORIGIN" \
  --data '{
  "return_path": "<return_path>"
}'

Parameters

Name	Location	Requirement	Description
`slug`	path · string	Required	Use the value defined for this resource.
`Origin`	header · string	Required	Use the value defined for this resource.

Request body

Send JSON with Content-Type: application/json. Nested field names identify their parent object; required markers apply within that object. Replace template values using the relevant resource and configured instrument rules.

Field	Type	Description & constraints
`return_path`Required in parent object	`string`	Defined by the resource contract.
`invitation_token`Optional	`string`	Defined by the resource contract.

Responses

Inspect HTTP status before parsing a body. These tables describe client response fields rather than invented successful transaction payloads.

200 · Provider-bound login challenge

Field	Type	Description & constraints
`provider_id`Required in parent object	`string`	Defined by the resource contract.
`institution_id`Required in parent object	`string`	Defined by the resource contract.
`return_path`Required in parent object	`string`	Defined by the resource contract.
`invitation_token`Optional	`string`	Defined by the resource contract.

403 · Unknown, inactive or mismatched company

No client body fields are defined for this response.

503 · Identity unavailable

No client body fields are defined for this response.

Retries & recovery

Keep the original request identifiers and any required idempotency key. A timeout does not establish failure. Read the original resource or command before another financial write; use expected versions for concurrent changes.

Error handling →Idempotency →