> ## Documentation Index
> Fetch the complete documentation index at: https://docs.younegotiate.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Exchange login handoff

> Exchange a short-lived, single-use Superadmin handoff for a non-remembered EcoMail Hub access and refresh token pair. Invalid, expired, reused, wrong-portal, and deleted-user handoffs are rejected with the same validation response.



## OpenAPI

````yaml /api/ecomailhub.openapi.yaml post /auth/login-as/exchange
openapi: 3.1.0
info:
  title: YouNegotiate EcoMail Hub API
  version: '2.0'
  description: Stateless API endpoints for EcoMail Hub / EcoPortal users.
servers:
  - url: https://api.ecomailhub.younegotiate.com
    description: Production
security: []
tags:
  - name: System
    description: Public EcoMail Hub domain system and health endpoints.
  - name: Authentication
    description: EcoMail Hub login, logout, password reset, and password change endpoints.
  - name: Profile
    description: Authenticated EcoMail Hub user profile endpoints.
  - name: Dashboard
    description: EcoMail Hub dashboard summary and notice-response bucket endpoints.
  - name: Manage Consumers
    description: >-
      EcoMail Hub consumer identity grouping and notice-response count
      endpoints.
  - name: Manage Creditors
    description: >-
      EcoMail Hub creditor profile and company-only member profile table
      endpoints.
  - name: Import Creditor Profiles
    description: EcoMail Hub creditor profile CSV import endpoints.
  - name: Manage Notice Response
    description: >-
      EcoMail Hub top-level notice-response review, reassignment, and close
      endpoints.
  - name: Manage Users
    description: EcoMail Hub user account management endpoints.
  - name: Reports
    description: EcoMail Hub one-time and scheduled CSV report endpoints.
  - name: Communications
    description: EcoMail Hub communication template editor endpoints.
paths:
  /auth/login-as/exchange:
    post:
      tags:
        - Authentication
      summary: Exchange login handoff
      description: >-
        Exchange a short-lived, single-use Superadmin handoff for a
        non-remembered EcoMail Hub access and refresh token pair. Invalid,
        expired, reused, wrong-portal, and deleted-user handoffs are rejected
        with the same validation response.
      operationId: ecomailhubExchangeLoginHandoff
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LoginHandoffExchangeRequest'
            example:
              handoff_token: >-
                01234567890123456789012345678901234567890123456789012345678901234567890123456789
      responses:
        '200':
          description: Handoff exchanged and EcoMail Hub token pair issued.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthTokenResponse'
              example:
                message: Logged in as ecomailhub user.
                data:
                  id: 42
                  name: MailHub Manager
                  email: mailhub.manager@example.com
                meta:
                  access_token: 1|access-token
                  refresh_token: refresh-token
                  token_type: Bearer
                  access_token_expires_at: null
                  refresh_token_expires_at: '2026-07-19T19:00:00.000000Z'
        '422':
          $ref: '#/components/responses/ValidationError'
        '429':
          $ref: '#/components/responses/TooManyRequests'
components:
  schemas:
    LoginHandoffExchangeRequest:
      type: object
      additionalProperties: false
      required:
        - handoff_token
      properties:
        handoff_token:
          type: string
          minLength: 80
          maxLength: 80
          description: >-
            Plaintext handoff received from the Superadmin login-as endpoint. It
            is single-use and must be exchanged before its expiry timestamp.
    AuthTokenResponse:
      type: object
      required:
        - message
        - data
        - meta
      properties:
        message:
          type: string
          example: Logged in.
        data:
          $ref: '#/components/schemas/EcomailhubUser'
        meta:
          type: object
          required:
            - access_token
            - refresh_token
            - token_type
            - access_token_expires_at
            - refresh_token_expires_at
          properties:
            access_token:
              type: string
            refresh_token:
              type: string
              description: >-
                Plaintext refresh token returned once. Store securely and send
                to POST /auth/refresh.
            token_type:
              type: string
              example: Bearer
            access_token_expires_at:
              type:
                - string
                - 'null'
              format: date-time
              description: >-
                Access token expiry timestamp when an expiry is assigned;
                otherwise null.
            refresh_token_expires_at:
              type: string
              format: date-time
    EcomailhubUser:
      type: object
      required:
        - id
        - name
        - email
      properties:
        id:
          type: integer
          example: 12
        name:
          type: string
          example: Maya Patel
        email:
          type: string
          format: email
          example: maya@example.com
        email_verified_at:
          type: string
          format: date-time
          nullable: true
        phone_no:
          type: string
          nullable: true
          example: (900) 509-0050
        created_at:
          type: string
          format: date-time
          nullable: true
        updated_at:
          type: string
          format: date-time
          nullable: true
    ValidationErrorResponse:
      type: object
      required:
        - message
        - errors
      properties:
        message:
          type: string
        errors:
          type: object
          additionalProperties:
            type: array
            items:
              type: string
    MessageResponse:
      type: object
      required:
        - message
      properties:
        message:
          type: string
  responses:
    ValidationError:
      description: Request validation failed.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ValidationErrorResponse'
          example:
            message: The given data was invalid.
            errors:
              email:
                - The email field is required.
    TooManyRequests:
      description: Rate limit exceeded.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/MessageResponse'
          example:
            message: Too Many Attempts.

````