> ## Documentation Index > Fetch the complete documentation index at: https://docs.crypto.westminister.tech/llms.txt > Use this file to discover all available pages before exploring further. # Login With 6-Digit PIN > Logs a user in using a 6-digit numeric PIN instead of a password. The client must provide either `email` **or** `phone_number` as the identifier, plus `pin`. - If `pin` was set during registration (or via a later PIN setup flow), this endpoint will verify the provided PIN using the same hashing mechanism as passwords. - On success, it returns an access token and basic user profile, similar to the email+password login. - On repeated failures, the PIN login for that user may be temporarily locked. ## OpenAPI ````yaml /openapi.yaml post /api/v1/users/login-pin openapi: 3.1.0 info: title: EmaalCoin API description: > EmaalCoin API reference. These APIs power cryptocurrency exchange between USDT and Fiat trading. - **On-Ramp**: Buy USDT with fiat (KES) via mobile money (STK Push for Kenya) - **Off-Ramp**: Sell USDT for KES with mobile money payout (Kenya) - **Ethereum, TRON, and Solana**: Multi-chain wallet support - **Merchant Offers**: Create and manage trading offers - **OTC Flows**: Bank and mobile money deposits/withdrawals for merchants - **Pricing engine**: FX quotes and fee profiles for quote-backed orders and transfers - **P2P/B2B transfers**: Internal and external stablecoin sends (USDT/USDC) with optional pricing snapshots - **Stablecoin swaps**: Treasury-backed two-leg USDT ↔ USDC conversion with BitGo confirmation, inventory reservation, and automatic refunds - **Multisig**: Collaborative and platform-managed multisig flows for high-value B2B version: 1.1.0 servers: - url: https://crypto.westminister.tech description: Production API (requires DNS for this hostname). - url: http://13.42.110.185:8080 description: >- UAT on EC2 (direct). Use this base when building proof PDF URLs if the production hostname does not resolve. security: [] tags: - name: Pricing description: >- Commercial pricing profiles and FX rate quotes (admin). Used with orders and transfers for auditable snapshots. - name: Transfers description: >- P2P and B2B stablecoin transfers (USDT/USDC). Optional fiat-equivalent pricing fields. B2B multisig behavior depends on wallet registration (synchronous completion vs proposal flow). - name: Stablecoin Swaps description: >- Treasury-backed USDT ↔ USDC conversions for BitGo provider-managed wallets on `tron`, `ethereum`, or `solana`. Collection confirms before treasury payout starts. Completion requires both legs and dual-asset balance synchronization. - name: Multisig description: >- Multisig wallet registration and TRON proposal/confirm flows (vendor/admin). - name: Escrow Wallets description: Escrow pool wallet metadata for off-ramp and operations. - name: Users description: >- User-related operations (registration, lookup, updates, counts, status changes) - name: Wallets-Users description: User wallet operations (create, manage, query balances) - name: Offers description: Offer operations (create, read, list, counts) - name: Orders description: Order operations (create, update, list, counts, stats) - name: Payment description: Payment initiation operations - name: Merchants description: > Merchant (vendor) onboarding and hierarchy operations. USE **GET /API/V1/AUTH/MERCHANTS** WITH **PAGE_ID** AND **PAGE_SIZE** TO PAGE MASTER VENDORS. USE **GET /API/V1/AUTH/MERCHANTS/{MERCHANT_ID}** FOR ONE MASTER VENDOR, **MERCHANT_WALLETS**, AND ALL **SUBVENDOR** ROWS WITH **WALLETS** (FULL TREE). - name: OTC Deposits description: > OTC fiat-to-crypto deposits (bank or mobile money). Rows live in **`otc_deposits`**. Merchants create drafts or one-shot deposits. **admin**, **otc_officer**, or **treasury** list all deposits. B2B bank flow uses draft, quote, submit, proof, assign, claim, settlement, and audit. **`credited_to_address`** is the merchant on-chain wallet treasury credits (resolved from the default wallet for **`requested_network`** on the master merchant ledger user or any **sub-vendor** under that merchant). **`GET /api/v1/auth/otc/deposits`** backfills missing **`credited_to_address`**/**`to_wallet_id`** when a wallet can be resolved. One-shot **`POST /api/v1/auth/otc/deposits`** persists the payout address when **`requested_network`** is sent. Bank proof PDFs upload via `POST .../proof` and are viewed at **`GET /otc-deposits-proof/{deposit_id}/{file}.pdf`** (relative **`proof_url`**/**`file_url`** plus API base URL). Merchants may edit tab-1 draft fields with **`PATCH /api/v1/auth/otc/deposits/{id}/draft`** while **`status`** is **`draft`**. - name: OTC Withdrawals description: >- OTC crypto-to-fiat withdrawals (bank or mobile money). Merchants create. Admin approves and executes. - name: OTC Config description: OTC display config (bank details, mobile money paybill) for merchant UI - name: Fiat Currencies description: > Shared platform **fiat_currencies** catalog. **GET /api/v1/auth/fiat-currencies** lists active rows for UI pickers. **GET /api/v1/auth/fiat-currencies/admin** lists all rows including inactive (admin). Admin manages rows with **GET /api/v1/auth/fiat-currencies/{id}**, **POST /api/v1/auth/fiat-currencies**, **PATCH /api/v1/auth/fiat-currencies/{id}**, and **DELETE /api/v1/auth/fiat-currencies/{id}**. Use for OTC, pricing, orders, remittance, and backoffice — not under **`/otc/...`**. Prefer **PATCH** with **`is_active: false`** over delete when a currency is referenced. - name: Countries description: >- Shared platform **countries** catalog. Public **GET /api/v1/countries** lists active rows for pickers. Auth **GET /api/v1/auth/countries** returns the same active catalog. Admin manages rows with **GET /api/v1/auth/countries/admin**, **GET /api/v1/auth/countries/{id}**, **POST /api/v1/auth/countries**, **PATCH /api/v1/auth/countries/{id}**, and **DELETE /api/v1/auth/countries/{id}**. - name: Files description: Authenticated file uploads for OTC receipts and proof artifacts. paths: /api/v1/users/login-pin: post: tags: - Users summary: Login With 6-Digit PIN description: > Logs a user in using a 6-digit numeric PIN instead of a password. The client must provide either `email` **or** `phone_number` as the identifier, plus `pin`. - If `pin` was set during registration (or via a later PIN setup flow), this endpoint will verify the provided PIN using the same hashing mechanism as passwords. - On success, it returns an access token and basic user profile, similar to the email+password login. - On repeated failures, the PIN login for that user may be temporarily locked. requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/LoginWithPin' examples: email_and_pin: summary: Login With Email And PIN value: email: user@example.com pin: '123456' phone_and_pin: summary: Login With Phone Number And PIN value: phone_number: '+254712345678' pin: '123456' responses: '200': description: Login successful content: application/json: schema: $ref: '#/components/schemas/LoginResponse' example: access_token: v2.local.eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... refresh_token: a1b2c3d4-e5f6-7890-abcd-ef1234567890 token_type: bearer expires_in: 900 user: id: 5c81c005-1c52-4e0d-85e2-862ee1cdd4d0 email: user@example.com phone_number: '+254712345678' first_name: John last_name: Doe role: customer kyc_status: pending '400': description: Invalid request (missing identifier, invalid pin format, etc.) '401': description: Invalid credentials or PIN login not enabled '429': description: Too many failed PIN attempts (temporary lockout) components: schemas: LoginWithPin: type: object description: Login using a 6-digit PIN and an identifier (email or phone number). properties: email: type: string format: email description: User email address. Required if phone_number is not provided. example: user@example.com phone_number: type: string description: >- User phone number in E.164 format (e.g., +254712345678). Required if email is not provided. example: '+254712345678' pin: type: string pattern: ^[0-9]{6}$ description: >- 6-digit numeric PIN set by the user during sign-up or via a separate PIN setup flow. example: '123456' required: - pin LoginResponse: type: object description: Authentication response returned by login endpoints. properties: access_token: type: string description: Short-lived PASETO bearer token used for authenticated API calls. example: v4.local.eyJzdWIiOiJ1c2VyLWlkIiwicm9sZSI6InVzZXIifQ... refresh_token: type: string description: >- Long-lived refresh token used to obtain new access tokens. Store securely and never expose in URLs or logs. example: a1b2c3d4-e5f6-7890-abcd-ef1234567890 token_type: type: string description: Token type, typically 'bearer'. example: bearer expires_in: type: integer format: int64 description: Access token lifetime in seconds. example: 900 user: $ref: '#/components/schemas/User' User: type: object properties: id: type: string format: uuid description: User ID. email: type: string format: email description: User email. phone_number: type: string description: Phone in E.164 format. first_name: type: string description: Given name. last_name: type: string description: Family name. role: type: string enum: - customer - vendor - subvendor - user - admin description: >- Assigned role. Admin can only be assigned via PUT /api/v1/auth/user/id/{id}/role by an existing admin. kyc_status: type: string description: Current KYC status. ````