--- title: "Step 2: Submit login credentials" component: pingone-api page_id: pingone-api:workflow-library:platform-sso-and-authorization/openid-connect-oidc/client-authentication-methods/test-the-workflow/client-secret-post/step-11-submit-login-credentials canonical_url: https://developer.pingidentity.com/pingone-api/workflow-library/platform-sso-and-authorization/openid-connect-oidc/client-authentication-methods/test-the-workflow/client-secret-post/step-11-submit-login-credentials.html section_ids: headers: Headers body: Body example-request: Example Request example-response: Example Response --- # Step 2: Submit login credentials ##   ```none POST {{authPath}}/{{envID}}/flows/{{postFlowID}} ``` To respond to the `USERNAME_PASSWORD_REQUIRED` flow state, the user initiates the `usernamePassword.check` action. The flow service calls the `POST {{authPath}}/{{envID}}/flows/{{flowID}}` endpoint operation and uses the `application/vnd.pingidentity.usernamePassword.check+json` custom media type in the `Content-type` HTTP request header to identify the action. The request body requires the `username` and `password` properties, which specify the user's login credentials. If the `usernamePassword.check` action completes successfully, the flow proceeds to the next sign-on policy action. ### Headers Content-Type      application/vnd.pingidentity.usernamePassword.check+json ### Body raw ( application/vnd.pingidentity.usernamePassword.check+json ) ```json { "username": "{{sharedUsername}}", "password": "{{userPassword}}" } ``` ## ### Example Request * cURL * C# * Go * HTTP * Java * jQuery * NodeJS * Python * PHP * Ruby * Swift ```shell curl --location --globoff '{{authPath}}/{{envID}}/flows/{{postFlowID}}' \ --header 'Content-Type: application/vnd.pingidentity.usernamePassword.check+json' \ --data '{ "username": "{{sharedUsername}}", "password": "{{userPassword}}" }' ``` ```csharp var options = new RestClientOptions("{{authPath}}/{{envID}}/flows/{{postFlowID}}") { MaxTimeout = -1, }; var client = new RestClient(options); var request = new RestRequest("", Method.Post); request.AddHeader("Content-Type", "application/vnd.pingidentity.usernamePassword.check+json"); var body = @"{" + "\n" + @" ""username"": ""{{sharedUsername}}""," + "\n" + @" ""password"": ""{{userPassword}}""" + "\n" + @"}"; request.AddStringBody(body, DataFormat.Json); RestResponse response = await client.ExecuteAsync(request); Console.WriteLine(response.Content); ``` ```golang package main import ( "fmt" "strings" "net/http" "io" ) func main() { url := "{{authPath}}/{{envID}}/flows/{{postFlowID}}" method := "POST" payload := strings.NewReader(`{ "username": "{{sharedUsername}}", "password": "{{userPassword}}" }`) client := &http.Client { } req, err := http.NewRequest(method, url, payload) if err != nil { fmt.Println(err) return } req.Header.Add("Content-Type", "application/vnd.pingidentity.usernamePassword.check+json") res, err := client.Do(req) if err != nil { fmt.Println(err) return } defer res.Body.Close() body, err := io.ReadAll(res.Body) if err != nil { fmt.Println(err) return } fmt.Println(string(body)) } ``` ```http POST /{{envID}}/flows/{{postFlowID}} HTTP/1.1 Host: {{authPath}} Content-Type: application/vnd.pingidentity.usernamePassword.check+json { "username": "{{sharedUsername}}", "password": "{{userPassword}}" } ``` ```java OkHttpClient client = new OkHttpClient().newBuilder() .build(); MediaType mediaType = MediaType.parse("application/vnd.pingidentity.usernamePassword.check+json"); RequestBody body = RequestBody.create(mediaType, "{\n \"username\": \"{{sharedUsername}}\",\n \"password\": \"{{userPassword}}\"\n}"); Request request = new Request.Builder() .url("{{authPath}}/{{envID}}/flows/{{postFlowID}}") .method("POST", body) .addHeader("Content-Type", "application/vnd.pingidentity.usernamePassword.check+json") .build(); Response response = client.newCall(request).execute(); ``` ```javascript var settings = { "url": "{{authPath}}/{{envID}}/flows/{{postFlowID}}", "method": "POST", "timeout": 0, "headers": { "Content-Type": "application/vnd.pingidentity.usernamePassword.check+json" }, "data": JSON.stringify({ "username": "{{sharedUsername}}", "password": "{{userPassword}}" }), }; $.ajax(settings).done(function (response) { console.log(response); }); ``` ```javascript var request = require('request'); var options = { 'method': 'POST', 'url': '{{authPath}}/{{envID}}/flows/{{postFlowID}}', 'headers': { 'Content-Type': 'application/vnd.pingidentity.usernamePassword.check+json' }, body: JSON.stringify({ "username": "{{sharedUsername}}", "password": "{{userPassword}}" }) }; request(options, function (error, response) { if (error) throw new Error(error); console.log(response.body); }); ``` ```python import requests import json url = "{{authPath}}/{{envID}}/flows/{{postFlowID}}" payload = json.dumps({ "username": "{{sharedUsername}}", "password": "{{userPassword}}" }) headers = { 'Content-Type': 'application/vnd.pingidentity.usernamePassword.check+json' } response = requests.request("POST", url, headers=headers, data=payload) print(response.text) ``` ```php setUrl('{{authPath}}/{{envID}}/flows/{{postFlowID}}'); $request->setMethod(HTTP_Request2::METHOD_POST); $request->setConfig(array( 'follow_redirects' => TRUE )); $request->setHeader(array( 'Content-Type' => 'application/vnd.pingidentity.usernamePassword.check+json' )); $request->setBody('{\n "username": "{{sharedUsername}}",\n "password": "{{userPassword}}"\n}'); try { $response = $request->send(); if ($response->getStatus() == 200) { echo $response->getBody(); } else { echo 'Unexpected HTTP status: ' . $response->getStatus() . ' ' . $response->getReasonPhrase(); } } catch(HTTP_Request2_Exception $e) { echo 'Error: ' . $e->getMessage(); } ``` ```ruby require "uri" require "json" require "net/http" url = URI("{{authPath}}/{{envID}}/flows/{{postFlowID}}") http = Net::HTTP.new(url.host, url.port); request = Net::HTTP::Post.new(url) request["Content-Type"] = "application/vnd.pingidentity.usernamePassword.check+json" request.body = JSON.dump({ "username": "{{sharedUsername}}", "password": "{{userPassword}}" }) response = http.request(request) puts response.read_body ``` ```swift let parameters = "{\n \"username\": \"{{sharedUsername}}\",\n \"password\": \"{{userPassword}}\"\n}" let postData = parameters.data(using: .utf8) var request = URLRequest(url: URL(string: "{{authPath}}/{{envID}}/flows/{{postFlowID}}")!,timeoutInterval: Double.infinity) request.addValue("application/vnd.pingidentity.usernamePassword.check+json", forHTTPHeaderField: "Content-Type") request.httpMethod = "POST" request.httpBody = postData let task = URLSession.shared.dataTask(with: request) { data, response, error in guard let data = data else { print(String(describing: error)) return } print(String(data: data, encoding: .utf8)!) } task.resume() ``` ### Example Response 200 OK ```json { "_links": { "self": { "href": "https://auth.pingone.com/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/flows/0332de8c-0052-43f4-8ff6-1f25f3e23af1" } }, "id": "0332de8c-0052-43f4-8ff6-1f25f3e23af1", "session": { "id": "3e753717-76e3-4b93-9023-d2d65d1648df" }, "resumeUrl": "https://auth.pingone.com/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/as/resume?flowId=0332de8c-0052-43f4-8ff6-1f25f3e23af1", "status": "COMPLETED", "createdAt": "2026-04-20T16:48:22.595Z", "expiresAt": "2026-04-20T17:03:31.953Z", "_embedded": { "user": { "id": "386e547a-45b6-410f-b61f-e4f4dc177fac", "username": "sharedTestUser" }, "application": { "name": "Shared-Web-App" } } } ```