Authentication

Overview

Survanta tenant users sign in with their registered email address and password through POST /api/mobile/auth/login. A successful response contains a JWT access token and its expiresAtUtc value. The retired researcher-only login routes are not part of the supported mobile contract.

Signing In

To sign in to the Survanta mobile app:

1. Open the Survanta app on your device.
2. On the login screen, enter your registered email address in the Email field.
3. Enter your password in the Password field.
4. Tap Sign In.

If the credentials and account are eligible for mobile access, the app receives an accessToken, expiresAtUtc, userId, tenantId, displayName, and userType (TenantUser). The client then sends the token to protected mobile endpoints.

Account Requirements

Before you can sign in, your account must meet the following conditions:

• Your account must be an active tenant-user account with a registered email address.
• Your access channel must permit mobile access.
• Your email must be confirmed before a JWT can be issued.
• Protected operations also enforce active same-tenant membership and the required permission, such as Tenant.SubmitQuestionnaires; successful login alone does not grant every mobile operation.

First-Time Login

If this is your first time signing in:

• An administrator may create your account, or may issue a one-time tenant invitation code.
• Invitation registration uses POST /api/mobile/auth/register-with-invitation. It creates the account but does not issue a JWT.
• After registration and any required email confirmation, sign in through the normal mobile login endpoint.

Sign Out

To protect your account, sign out in the client when you are done:

1. Tap the menu icon or your profile avatar in the top corner of the app.
2. Select Sign Out.
3. Confirm the sign-out when prompted.

The current backend exposes no mobile logout or JWT-revocation endpoint. Signing out must remove the JWT from client storage; the issued JWT otherwise remains valid until its expiry, subject to the authorization checks performed by each endpoint. If the client registered a push device token, it should also call DELETE /api/Researcher/device-token before discarding the JWT.

Failed Login Attempts

• If you enter incorrect credentials, the app displays an error message. Check that your email and password are correct.
• Mobile login is rate-limited. Repeated requests can receive HTTP 429; wait before retrying.
• The exposed mobile recovery endpoints can send and confirm an emailed code, but they do not expose an endpoint that sets a new password. See the recovery-code guide and contact your administrator when a password must be changed.

Security Notes

• The server stores the account password as an ASP.NET Identity password hash, not as plain text.
• Production clients must use HTTPS and store JWTs in platform-protected secure storage.
• JWTs expire automatically. The current API has no refresh-token endpoint, so the client must return the user to login after expiry.
• Do not share credentials or tokens. Each tenant user should use their own account.

Subscription requirement

Sign-in is not gated by the organization's subscription: login succeeds and a JWT is issued even when the subscription has expired. Treat a successful sign-in as identity only. Protected operations are checked separately and refuse with errorCode 1001 / code "SubscriptionExpired".

See Mobile Subscription Contract.