POST /tokens. The fields depend on the grant: only the password grant returns username, the MFA grant omits user, and a login that still needs MFA carries mfa, mfa_vendor and mfa_type and no refresh_token.{
"username": "string",
"user": "string",
"territory": "string",
"domain": "string",
"site": "string",
"group": "string",
"department": "string",
"uid": "string",
"login": "string",
"scope": "string",
"user_email": "string",
"displayName": "string",
"access_token": "string",
"expires_in": 0,
"token_type": "string",
"refresh_token": "string",
"client_id": "string",
"apiversion": "string",
"mfa": "string",
"mfa_vendor": "string",
"mfa_type": "string",
"avatar": "string"
}