How to handle non-resource POST request and response ? (like session login)

[sylver]

As stated in the title, if following the JSON API Specifications, how to handle requests and responses for non-resource data.

For example, what would look like a login request and its response ?

Request :

POST /session HTTP/1.1
Content-Type: application/vnd.api+json
Accept: application/vnd.api+json

{
  "jsonapi": {
    "version": "1.0"
  },
  "data": {
    "grant_type": "password",
    "username": "john.doe",
    "password": "foobar"
  }
}

Response :

HTTP/1.1 200 OK
Content-Type: application/vnd.api+json

{
  "jsonapi": {
    "version": "1.0"
  },
  "data": null,
  "meta": {
    "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ",
    "token_type": "Bearer",
    "expires_in": 86400
  }
}

[michaelhibay]

This topic seems to touch on it well.

Json API response format for non-resource data, like oAuth token

Hey, I am returning the oauth access token from my api and I am puzzled as to how to correctly do it in the jsonapi format. Treating it as a resource seems wrong, I don’t want to return an ID for the token. Is it correct, to ignore the jsonapi format for this? How would I format it otherwise? Would I just jot it into the meta part like this? { "jsonapi": { "version": "1.0" }, "data": null, "meta": { "access_token": "Qcg6yI1a5qCxXgKWtSAbZ2MIHFChHAq0Vc1Lo4TX", "token_type": …

On a better note I honestly think being more authorization scheme adherent would be the better policy, in which case you could provide a link to the login URL with the appropriate vocabulary.

Are you asking about any additional scenarios as well, or is this strictly limited to auth?