The POST /{environmentId}/flows/{flowId} operation initiates an action to allow users to login with a username and password. The request body requires the username and password attributes. The values for these properties provided by the user are verified in this action. This operation uses the application/vnd.pingidentity.usernamePassword.check+json custom media type as the content type in the request header.

If there is a user already associated with the current flow, and a username value is provided in the request body, then the value of username must identify the user associated with the session.

In the response data, the status property value indicates that the one-time password validation step used in a multi-factor authentication flow is a required action. The validateOTP HAL link to initiate this required step is also included in the response.