# Start practitioner login

Canonical page: https://docs.ovok.com/api/tenant-authentication/start-practitioner-login

`POST /auth/tenant/Practitioner/login/start`

Starts a practitioner login: checks the email and password and returns either a session code plus the list of tenants the practitioner can enter, or, when the user has MFA enrolled, a login ID for the MFA step.

**Auth:** none.
**Scope:** no tenant yet. A practitioner's User is server-wide; the tenant is chosen in `login/token`.

## Behaviour

- This is step 1 of a PKCE login. Generate a random `codeVerifier`, send its S256 hash as `codeChallenge` here, and send the `codeVerifier` itself to `POST /auth/tenant/Practitioner/login/token`.
- Response `nextStep`:
  - `token`: no MFA. The response carries `sessionCode` and `profiles`, one entry per Practitioner membership of the user: its `tenantCode`, `project` (`id`, `resourceType`, `name`), `profile`, `admin` (true when the user is an admin of that project), `isMainProject` and `parentProjectId`.
  - `mfa`: the user has MFA enrolled. Pass `loginId` and the current TOTP code to `POST /auth/tenant/Practitioner/login/mfa`, which returns the same `profiles` list.
- `isMainProject` is `true` when the project has no parent project, and `null` when the hierarchy could not be read. `parentProjectId` is set only when the caller is also a member of that parent; otherwise it is `null`.
- `PRACTITIONER_LOGIN_ENABLED` is not checked here; it is checked in `login/token` against the chosen tenant.
- A wrong email, an unknown account, an account without a password and a wrong password all give the same 401 `Invalid email or password.`
- After 5 failed sign-ins for one email within 15 minutes, that email's sign-ins answer 429 with `Retry-After` for 15 minutes, the right password included, whether or not the email has an account. A successful sign-in resets the count.
- Error responses are delayed to take at least one second.

## Example

```bash
curl -X POST 'https://api.sandbox.ovok.com/auth/tenant/Practitioner/login/start' \
  -H 'Content-Type: application/json' \
  -d '{
    "email": "max.mustermann@example.com",
    "password": "your-password",
    "codeChallenge": "<base64url S256 hash of your codeVerifier>"
  }'
```