> ## Documentation Index
> Fetch the complete documentation index at: https://docs-staging.auth0-mintlify.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Database/AD/LDAP (Active)

> Deprecated active authentication endpoint for database, AD, and LDAP connections; use the Resource Owner Password grant instead.

## Endpoint

`POST /oauth/ro`

> [!NOTE]
>
> This endpoint is part of the legacy authentication pipeline and has been replaced in favor of the [Password Grant](#resource-owner-password). For more information on the latest authentication pipeline refer to [Introducing OIDC Conformant Authentication](https://docs-staging.auth0-mintlify.app/api-auth/intro).

Use this endpoint for API-based (active) authentication. Given the user credentials and the `connection` specified, it will do the authentication on the provider and return a JSON with the Access Token and ID Token.

### Remarks

* This endpoint only works for database connections, passwordless connections, Active Directory/LDAP, Windows Azure AD and ADFS.

* The main difference between passive and active authentication is that the former happens in the browser through the [Auth0 Login Page](http://manage.auth0.com/login) and the latter can be invoked from anywhere (a script, server to server, and so forth).

* The sample auth0.js script uses the library version 8. If you are using auth0.js version 7, please see this [reference guide](https://auth0.com/docs/libraries/auth0js/v7).

### Learn More

* [Database Identity Providers](https://auth0.com/docs/authenticate/database-connections)
* [Rate Limits on User/Password Authentication](https://auth0.com/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy)
* [Active Directory/LDAP Connector](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/active-directory-ldap/ad-ldap-connector)

## Body Parameters

**client\_id** `string` *required*

The `client_id` of your application.

**username** `string` *required*

Username/email of the user to login.

**password** `string` *required*

Password of the user to login.

**connection** `string` *required*

The name of the connection to use for login.

**scope** `string`

Set to `openid` to retrieve also an ID Token.

**grant\_type** `string` *required*

Set to `password` or `urn:ietf:params:oauth:grant-type:jwt-bearer`.

**device** `string`

Required when `grant_type` is `urn:ietf:params:oauth:grant-type:jwt-bearer`.

**id\_token** `string`

Required when `grant_type` is `urn:ietf:params:oauth:grant-type:jwt-bearer`.

## Response Schema

200

\{}

application/json

**id\_token** `string`

The ID token.

**access\_token** `string`

The access token.

**token\_type** `string`

The type of token. Usually `Bearer`.

400

\{}

application/json

**error** `string`

Error code.

**error\_description** `string`

Error description.

## Response Messages

| Status | Description |
| - | - |
| 200 | Successful authentication response |
| 400 | Bad Request |