CreateAccountSSOCode

Description: Creates a one-time terminal sign-in URL for an enabled trading account. The link is bound to the account's brand and expires after 60 seconds.

Access Control

🔐 Session required: manager, admin, dealer, CRM manager, or CRM admin.

The normal grant requires access_backoffice = 1 and the explicit create_account_sso = 1 permission. Only a global super admin (super_admin = 1) bypasses these grant checks. Brand-admin status does not automatically grant this permission. The server checks current brand/group visibility, account enablement, and licensed API admission. The brand's configured terminal host must also be approved for terminal access; API admission alone is insufficient.

Request Parameters

Name	Type	Required	Description
login	integer	Yes	Positive login of the enabled account to sign in.

Request Example

{
  "command": "CreateAccountSSOCode",
  "extID": "sso-account-1",
  "__token": "<manager session JWT>",
  "data": {
    "login": 123456
  }
}

Response Parameters

The fields below are returned inside data in the TCP response envelope.

Name	Type	Description
login_url	string	Complete terminal URL with sso_code=<64 lowercase hex characters>. The brand default language is used, falling back to en.
expires_in	integer	Code lifetime in seconds (60).

Response Example

{
  "extID": "sso-account-1",
  "status": 200,
  "data": {
    "login_url": "https://terminal.example/en/platform?sso_code=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
    "expires_in": 60
  }
}

Codes are stored as hashes in bounded process memory. A server restart invalidates outstanding codes. Each recognized code is consumed by one redemption attempt, including an attempt on the wrong brand.

Errors

Status	Error	Description
400	INVALID_DATA	login is missing, not an integer, or not positive.
403	RET_NOT_ENOUGH_RIGHTS	Router staff permission or scope check failed.
403	SSO_ACCESS_DENIED	Caller/target is disabled, required permission is missing, or current account/group visibility checks failed.
403	BRAND_NOT_AVAILABLE	Target brand is not admitted for licensed API access.
503	SSO_CONFIGURATION_INVALID	Terminal URL or language cannot be used to form a safe URL.
503	SSO_CODE_UNAVAILABLE	Secure code generation failed or the in-memory store reached capacity.
503	LICENSE_NOT_ACTIVE	A required active license lease is unavailable.