LoginID take-home — live API demo

This page lets you drive the actual identity API live from your browser, so you can watch its access rules and safeguards work in real time instead of taking our word for it.

● Get a token

You paste a temporary QA test login here only to get a real access token for this demo — it stays in this browser tab, is never saved anywhere, and is only ever used to talk to this one page's own login endpoint.

1 Masked search vs. full read

This shows the same person's record returned two different ways depending on what the caller is allowed to see — one version hides sensitive fields, the other reveals them — proving access is limited to what each caller has earned, not an all-or-nothing switch.

Needs a profile:search token and a profile:read:any token minted above.
Masked (profile:search)
—
not run
run the panel to see a real response
Full (profile:read:any)
—
not run
run the panel to see a real response

2 The two 403s

This shows that being denied for "you don't have permission" and being denied because "that record doesn't exist" look exactly, byte-for-byte, the same from the outside, so no one can use the error message to go fishing for which accounts are real.

Needs a profile:read:own token minted above. Uses two fresh, unpredictable record ids this credential was never granted — one may exist, one almost certainly doesn't; neither matters to the result.
Record A
—
not run
run the panel to see a real response
Record B
—
not run
run the panel to see a real response
byte-equality check: not run yet

3 The 401

This shows the API simply refuses to answer at all when no valid login is presented, proving there's no accidental back door for anonymous requests.

No token needed — that's the point.
No Authorization header
—
not run
run the panel to see a real response

4 The reason_code enum

This shows the system accepts a recognized reason for a request and rejects a made-up one, proving it enforces a fixed, checkable list of valid reasons rather than trusting whatever a caller types in.

Needs a profile:read:any token minted above (and, if panel 1 hasn't run yet, a profile:search token too, to find a real record id).
reason_code=support_ticket (accepted)
—
not run
run the panel to see a real response
reason_code=made_up_reason (rejected)
—
not run
run the panel to see a real response

5 The rate limit tripping

This shows the API cutting off a rapid burst of real requests in real time, proving it can defend itself against being hammered rather than just claiming to.

Runs last on purpose: the limit is shared by every visitor currently using the same seeded QA credential, so tripping it here really does affect anyone else driving this panel in the same window — not a per-visitor sandbox.

Needs a profile:search token minted above. Fires real requests, one at a time, until one comes back 429 or a safety cap is hit.
Last request in the burst
—
not run
run the panel to see a real response