Open the screen lock with the account PIN
POST/api/session/unlock
Lifts the lock from the SAME session — it never establishes one. Every route here is behind the session guard, so a PIN alone authenticates nobody; it re-opens a session that already passed the password and, where the workspace requires it, a second factor.
Five wrong tries END the session (pin_attempts_exhausted, 401): a
four-digit PIN is ten thousand guesses, and the counter is what makes it
a lock rather than a speed bump. pin_unavailable (409) means there is
no PIN to check against — the workspace disabled the feature, or the
account never set one — and the panel must fall back to a full sign-in.
Request
Responses
- 200
- 401
- 409
- 422
Unlocked.
Out of tries — the session was destroyed (pin_attempts_exhausted).
There is no PIN to check against (pin_unavailable).
Wrong PIN (pin_incorrect), with attempts_left.