KIO Link
KIO Link XC APIKIO Link API
KIO BMSHuawei BMSHuawei Alert
KIO Link XC APIKIO Link API
KIO BMSHuawei BMSHuawei Alert
  1. Auth
  • Auth
    • Overview
    • Log in
      POST
    • Send a one-time sign-in token
      POST
    • Log in with Apple
      POST
    • Validate a session token
      GET
    • Sign in with a one-time sign-in token
      POST
    • Request a password reset
      POST
    • Get the user of a password reset token
      GET
    • Reset a password
      POST
    • Submit a business registration request
      POST
    • Enable two-factor authentication
      POST
    • Confirm a two-factor login
      POST
  • Application Content
    • List application content
    • Create application content
    • Get application content by slug
    • Get application content by public id
    • Partially update application content
    • Delete application content
  • Businesses
    • Overview
    • Business Users
      • Overview
      • List business users by business
      • List a business's users
      • Create a business user
      • Get a business user
      • Update a business user
      • Upload a business user's avatar
      • Delete a business user's avatar
      • Deactivate business users
      • Search business users
      • Search a business's users
      • Send a password reset email to a business user
      • Reset a business user's daily sign-in code limits
      • Toggle a business user's two-factor authentication
      • Import business users from CSV
      • Export all business users
      • Set whether I receive releases
      • Set whether I receive alerts
      • Request the deletion of my account
    • Business Roles
      • Overview
      • List business user roles
      • Create a business user role
      • Get a business user role
      • Update a business user role
      • Delete a business user role
    • Business Permissions
      • Overview
      • List business user permissions
      • Create a business user permission
      • Delete a business user permission
    • Business Consoles
      • Overview
      • List a business's consoles
      • Create a business console
      • Delete a business console
    • Business Devices
      • Overview
      • List a business's devices
      • Search a business's devices
      • Export all business devices
      • Export my business's devices
      • Import business devices from CSV
      • Start device transfers from CSV
      • Import device statuses from CSV
      • Delete business devices
      • Change a device's owner
      • Get a business's device transfer log
    • Business Racks
      • Overview
      • Export all business racks
      • Assign a rack to a business
      • List a business's racks
      • List all business racks
      • Change a business rack's status
      • Delete business racks
      • Restore a deleted business rack
      • Import business racks from CSV
    • Business Locations
      • Overview
      • Update a business's status and datacenters
      • Migrate business locations to datacenters
      • Remove the old locations field from businesses
      • Migrate business user locations to datacenters
      • Migrate business device locations to datacenter names
    • Business Reports
      • Overview
      • Send the visits reports
      • Download a visits report
      • Set a business's report recipients
    • List businesses
    • Search businesses
    • Search businesses by name or extra data
    • Export businesses
    • Get a business
    • Create a business
    • Import businesses from CSV
    • Update a business
    • Delete a business
  • Banned Devices
    • List banned devices
    • Check if a device is risky or banned
    • Get a banned device
    • Create a banned device
    • Update a banned device
    • Delete a banned device
  • Data Centers
    • Listar data centers
    • Crear un data center
    • Actualizar un data center
    • Eliminar un data center
  • Intake Forms
    • List intake form reponses
    • Get an intake form's response
    • Get an intake form's response license file
    • Get an intake form's response identification file
    • Download intake form responses report
    • Create an intake form's response
    • Upload a license file to an intake form's response
    • Upload an identification file to an intake form's response
    • Update an intake form's response
    • Delete an intake form's response
  • Users
    • Overview
    • Permissions
      • Overview
      • Generate KIO user permissions
      • Generate business user permissions
      • List KIO user permissions
      • Create a KIO user permission
      • Delete a KIO user permission
    • Roles
      • Overview
      • List KIO user roles
      • Create a KIO user role
      • Get a KIO user role
      • Update a KIO user role
      • Delete a KIO user role
    • User Groups
      • Overview
      • List user groups
      • Create a user group
      • Update a user group
      • Delete a user group
    • List KIO users
    • Create a KIO user
    • Get a KIO user
    • Update a KIO user
    • Activate or deactivate a KIO user
    • Delete a KIO user
    • Generate a session token for a user
    • Export KIO users
    • Search active KIO users by name
    • Search KIO users
    • Look up an employee in SuccessFactors
    • Import KIO user updates from CSV
  • External Users
    • Overview
    • List external users
    • Find external users to invite
    • Search external users
    • Export external users
    • Create an external user
    • Edit an external user
    • Update an external user
    • Upload an external user's avatar
    • Delete an external user's avatar
    • Delete an external user
  • Send App Notification
    POST
  • Events Locations
    GET
  • Fetch Wires
    GET
  • Create Business Temporary Secret
    POST
  • Schemas
    • Auth
      • Auth Session
      • Two-Factor Status
      • Two-Factor Challenge
      • KIO User Session
    • Businesses
      • Business Users
        • Business User Role
        • Datacenter Access
        • Business User
        • Business User With Relations
        • Business User Permission
      • Business Devices
        • Business Device
        • Business Device Log Entry
      • Business Racks
        • Business Rack
        • Datacenter Rack
      • Business
      • Datacenter Assignment
      • Business List Item
      • Business Console
    • Users
      • User Role
      • User
      • User Permission
      • User Group
      • Permission Catalog
      • SuccessFactors Employee
    • External Users
      • External User
    • ApplicationContentCreate
    • ApplicationContentUpdate
    • ApplicationContent
    • ApplicationContentListResponse
    • Banned Device
    • Error
    • LanguageEntry
    • Pagination
    • Intake Form
    • DataCenter
    • LocalizedContent
    • Delete Result
    • Import Row Error
    • Bulk Write Result
    • Message
    • Personal Device
  1. Auth

Sign in with a one-time sign-in token

QA Environment
https://qa-api.kiolinkapp.com
QA Environment
https://qa-api.kiolinkapp.com
POST
https://qa-api.kiolinkapp.com
/v1/auth/validate-ots-token
Auth
Last modified:2026-10-05 20:03:06
Maintainer:Not configured
Exchanges a one-time sign-in (OTS) token, sent by Send a one-time sign-in token, for a business user session.
The session token is valid for 24 hours (instead of the usual 30 days).
Counts as a verified sign-in: the user's 2FA grace period is pushed forward (two_fa.refreshed_limit_date) and the sign-in counts toward the daily limit.
The OTS token is not consumed; it can be used again until it expires.
This endpoint is public.

Request

Body Params application/jsonRequired

Example
{
  "otsToken": "7B2E9D"
}

Request Code Samples

Shell
JavaScript
Java
Swift
Go
PHP
Python
HTTP
C
C#
Objective-C
Ruby
OCaml
Dart
R
Request Request Example
Shell
JavaScript
Java
Swift
curl --location 'https://qa-api.kiolinkapp.com/v1/auth/validate-ots-token' \
--header 'authorization: <api-key>' \
--header 'Content-Type: application/json' \
--data '{
  "otsToken": "7B2E9D"
}'

Responses

🟢200Signed in
application/json
Signed in.
Bodyapplication/json

Example
{
    "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJfaWQiOiI2NWYxYzJhOWU0YjBhMWIyYzNkNGU1ZjYifQ.c2lnbmF0dXJl",
    "user": {
        "_id": "65f1c2a9e4b0a1b2c3d4e5f6",
        "firstname": "Ana",
        "lastname": "López",
        "email": "ana.lopez@example.com",
        "password": "$2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy",
        "devices": [],
        "dc_access": "65f1c2a9e4b0a1b2c3d4e5c3",
        "device_tokens": [],
        "consoles": [],
        "active": true,
        "role": {
            "_id": "65f1c2a9e4b0a1b2c3d4e5b2",
            "name": "Administrador",
            "slug": "admin",
            "show_in_releases": true,
            "__v": 0
        },
        "business": "65f1c2a9e4b0a1b2c3d4e5a1",
        "created_at": "2024-03-13T18:22:01.000Z",
        "level": "Administrador",
        "show_in_releases": true,
        "show_in_alerts": true,
        "time_zone": "America/Mexico_City",
        "verify_email": "deliverable",
        "delete_request": false,
        "id_service_desk_plus": "0",
        "two_factor_auth_activated": false,
        "two_factor_auth_limit_date": "04-11-2026",
        "two_factor_auth_unavailable": false,
        "password_limit_date": "2027-01-03T19:00:00.000Z",
        "sent_feedback": false,
        "__v": 0
    },
    "permissions": [
        "xc-requests",
        "kiolink-events"
    ],
    "two_fa": {
        "verified_by": "ots",
        "refreshed_limit_date": "04-11-2026",
        "grace_days_config": 30
    }
}
🟠400No pending token matches `otsToken`
🟠404The token expired, or its user no longer exists
🔴500Unexpected error
Modified at 2026-10-05 20:03:06
Previous
Validate a session token
Next
Request a password reset
Built with