Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/fredy-rizo/despacho-backend/llms.txt

Use this file to discover all available pages before exploring further.

This endpoint authenticates a registered lawyer account. It looks up the account by email (case-insensitive), then uses bcrypt’s compare function to validate the supplied plaintext password against the stored hash. On a successful match, a JSON Web Token is signed with the server’s secret key and set to expire in 365 days. The token is also persisted on the user’s MongoDB document so the server can cross-reference active sessions. Both the signed token and a trimmed user object (_id, email, role) are returned in the response — no further lookup is needed by the calling client. 
POST /api/lawyer/user/login
Authentication: None — this is a public endpoint.

​
Request Body

​
email
string
required
The lawyer’s registered email address. Looked up case-insensitively in the database, so Abogado@Despacho.com and abogado@despacho.com resolve to the same account.
​
password
string
required
The account password in plaintext. Compared against the bcrypt hash stored in the database using bcrypt.compare — never logged or persisted during this operation.

​
Example Request

curl -X POST http://localhost:3000/api/lawyer/user/login \
  -H "Content-Type: application/json" \
  -d '{"email": "abogado@despacho.com", "password": "SecurePass123"}'

​
Responses

​
200 — Authentication Successful

Credentials are valid. Returns a signed JWT and the authenticated user’s details. 
{
  "msj": "Bienvenido!",
  "status": true,
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "user": {
    "_id": "64f1a2b3c4d5e6f7a8b9c0d1",
    "email": "abogado@despacho.com",
    "role": [{ "name": "Admin", "value": "1" }]
  }
}
​
msj
string
Human-readable welcome message. Value: "Bienvenido!".
​
status
boolean
true when authentication succeeded.
​
token
string
Signed JWT bearer token. Valid for 365 days from the moment of issue. Include this value in the Authorization header of all subsequent requests to protected endpoints.
​
user
object
A trimmed representation of the authenticated lawyer’s account.

​
203 — Invalid Credentials or Missing Fields

Returned for two distinct conditions:
  1. Missing fields — email or password was absent from the request body.
{
  "msj": "Completa todos los campos para iniciar sesion",
  "status": false
}
  1. Wrong password — The email was found but the password did not match the stored bcrypt hash.
{
  "msj": "Contraseña invalida",
  "status": false
}

​
403 — Email Not Found

No account exists for the supplied email address. 
{
  "msj": "Email no valido",
  "statis": false
}

​
500 — Internal Server Error

An unexpected server-side or database error occurred. The raw error object is returned in the response body. 
{
  "name": "MongoServerError",
  "message": "..."
}

​
Using the Token

Every protected endpoint in the Despacho API requires the JWT to be sent as a Bearer token in the Authorization request header: 
Authorization: Bearer <token>
The following example demonstrates calling a hypothetical protected route with the token obtained from a successful login: 
curl -X GET http://localhost:3000/api/lawyer/appointments \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
If the Authorization header is missing or the token is invalid/expired, protected endpoints will return a 401 Unauthorized or 403 Forbidden response.

​
JWT Payload

The token is a standard HS256-signed JWT. After decoding (e.g. at jwt.io), the payload contains: 
{
  "_id": "64f1a2b3c4d5e6f7a8b9c0d1",
  "email": "abogado@despacho.com",
  "role": [{ "name": "Admin", "value": "1" }],
  "iat": 1705312200,
  "exp": 1736848200
}
ClaimTypeDescription
_idstringMongoDB ObjectId of the authenticated lawyer
emailstringEmail address of the authenticated lawyer
rolearrayRole objects at the time the token was issued
iatnumberUnix timestamp — when the token was issued
expnumberUnix timestamp — when the token expires (issued + 365 days)
The token is signed with the server’s SECRET environment variable using the HS256 algorithm. Tokens cannot be validated without the correct secret.
Store the JWT securely. In browser-based clients, prefer httpOnly cookies or a secure in-memory store over localStorage — tokens stored in localStorage are accessible to JavaScript and vulnerable to XSS attacks. Never include the token in a URL query parameter or write it to application logs, as it grants full authenticated access for up to 365 days.
If a protected endpoint starts returning 401 or 403 responses, the token has likely expired. Simply re-call POST /api/lawyer/user/login with the same credentials to receive a fresh token. The new token is also saved to the user record in the database, replacing the previous one.

Build docs developers (and LLMs) love

Get started for freeTalk to us