=====01a1c5c1-3fcd-70bc-8113-d7e46fe21754=====
# 01a1c5c1-3fcd-70bc-8113-d7e46fe21754  2026-11-10 13:58:58  curl/hunter-1  status=200  87ms
POST https://infoportal.baloise.de/auth/rest/public/authentication/dynamic-steps/portal-redirect/activate
--- request (895 B application/x-www-form-urlencoded)
POST /auth/rest/public/authentication/dynamic-steps/portal-redirect/activate HTTP/1.1
sec-ch-ua: "Chromium";v="152", "Not?A_Brand";v="24", "Google Chrome";v="152"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Accept: application/json
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cache-control: max-age=0
Cookie: CSRFT759-S=c0rElAszzZ7flx9F5ULPHQ; AL_SESS-S=AcAFRWo6WU9Z73W5VuGYk_K2F2LV3y0SCMhboxX7SsI9YaNL8d_MH!xkPliLWJ9X5zy6
Host: infoportal.baloise.de
X-Bug-Bounty: BBS:dwbzn
X-Same-Domain: 1
X-CSRFT759: c0rElAszzZ7flx9F5ULPHQ
Content-Length: 0
Content-Type: application/x-www-form-urlencoded
--- response (1374 B application/json;charset=utf-8)
HTTP/1.1 200 OK
Date: Tue, 10 Nov 2026 13:58:58 GMT
Server: Apache
Content-Length: 647
Expires: 0
Last-Modified: Tue, 10 Nov 2026 13:58:58 GMT
Cache-Control: no-store, no-cache, must-revalidate
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
Permissions-Policy: accelerometer=(self), ambient-light-sensor=(self), autoplay=(self), camera=(self), display-capture=(self), document-domain=(self), encrypted-media=(self), fullscreen=(self), geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), midi=(self), payment=(self), usb=(self), xr-spatial-tracking=(self)
Content-Type: application/json;charset=utf-8

{"meta":{"type":"jsonapi.metadata.document","timestamp":"2026-11-10T14:58:58.754+01:00","uiSettings":{"path":"{{SPA}}/auth/flow/portal_ao/password","stepId":"default-username-password","pageSettings":{"dynamicStepActivationTargets":[{"targetStepId":"portal-redirect","activatable":true,"deactivatable":true,"activated":true}],"publicSelfServiceLink":"{{SPA}}/self-service/select/flow/password-reset-init","additionalAuthenticationButtons":{"targets":[]}},"pageId":"password","flowId":"portal_ao","flowType":"auth"}},"data":{"type":"authentication.session","id":"761227bfe5745d51272e1a431ad251cf","attributes":{"nextAuthStep":"PASSWORD_REQUIRED"}}}

=====01a1cbe2-f052-7724-89a7-71bfb7d31f74=====
# 01a1cbe2-f052-7724-89a7-71bfb7d31f74  2026-11-11 18:33:29  curl_cffi.requests/hunter-2  status=200  111ms
POST https://infoportal.baloise.de/auth/rest/public/authentication/dynamic-steps/retrieve
--- request (443 B application/json)
POST /auth/rest/public/authentication/dynamic-steps/retrieve HTTP/1.1
Host: infoportal.baloise.de
Accept-Encoding: gzip, deflate, br
Cookie: CSRFT759-S=81!cRLNKM3Fn6wf2lLNgQA; AL_SESS-S=ATt0XQBtetHI_cHQdI8f90JwX6ddIMvfkZkC_e83c2ij2NALcyshhrU8lkGqlRx5ln8O
X-Bug-Bounty: BBS:dwbzn
Accept: application/vnd.api+json, application/json
Content-Type: application/json
X-Same-Domain: 1
X-CSRFT759: 81!cRLNKM3Fn6wf2lLNgQA
Content-Length: 0
--- response (819 B application/vnd.api+json)
HTTP/1.1 200 OK
Date: Wed, 11 Nov 2026 18:33:29 GMT
Server: Apache
Content-Length: 99
Expires: 0
Last-Modified: Wed, 11 Nov 2026 18:33:29 GMT
Cache-Control: no-store, no-cache, must-revalidate
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
Permissions-Policy: accelerometer=(self), ambient-light-sensor=(self), autoplay=(self), camera=(self), display-capture=(self), document-domain=(self), encrypted-media=(self), fullscreen=(self), geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), midi=(self), payment=(self), usb=(self), xr-spatial-tracking=(self)
Content-Type: application/vnd.api+json

{"meta":{"type":"jsonapi.metadata.document","timestamp":"2026-11-11T19:33:29.932+01:00"},"data":[]}

=====9336710dd2a208b0d45300125ba6fc70=====
# 9336710dd2a208b0d45300125ba6fc70  2026-11-10 07:46:00  agent-browser/hunter-2  status=200
POST https://infoportal.baloise.de/auth/rest/public/authentication/location/interpret
--- request (752 B application/json)
POST /auth/rest/public/authentication/location/interpret HTTP/1.1
Accept: application/json, text/plain, */*
Accept-Language: en
Cache-Control: no-cache
Content-Type: application/json
If-Modified-Since: 0
Pragma: no-cache
Referer: https://infoportal.baloise.de/auth/ui/app/auth/application/access?Location=https%3A%2F%2Finfoportal%2Ebaloise%2Ede%2Fgroup%2Fao
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/157.0.0.0 Safari/537.36
X-Bug-Bounty: BBS:dwbzn
X-CSRFT759: 9C9RmrLZRNMZ3NPcs9Pbgg
X-Same-Domain: 1
sec-ch-ua: "Not-A.Brand";v="99", "Google Chrome";v="157", "Chromium";v="157"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

{"location":"https://infoportal.baloise.de/group/ao"}
--- response (934 B application/vnd.api+json)
HTTP/1.1 200
Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Type: application/vnd.api+json
Date: Tue, 10 Nov 2026 07:46:00 GMT
Expires: 0
Keep-Alive: timeout=10, max=493
Last-Modified: Tue, 10 Nov 2026 07:46:00 GMT
Permissions-Policy: accelerometer=(self), ambient-light-sensor=(self), autoplay=(self), camera=(self), display-capture=(self), document-domain=(self), encrypted-media=(self), fullscreen=(self), geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), midi=(self), payment=(self), usb=(self), xr-spatial-tracking=(self)
Referrer-Policy: same-origin
Server: Apache
Strict-Transport-Security: max-age=31536000
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN

{"meta":{"type":"jsonapi.metadata.document","timestamp":"2026-11-10T08:46:00.226+01:00"},"data":{"type":"location.interpretation","id":"59","attributes":{}}}

=====01a1c5c1-40ec-77ea-a583-a16e9c1d8d19=====
# 01a1c5c1-40ec-77ea-a583-a16e9c1d8d19  2026-11-10 13:58:58  curl/hunter-1  status=200  71ms
POST https://infoportal.baloise.de/auth/rest/public/authentication/goto-targets/retrieve
--- request (878 B application/x-www-form-urlencoded)
POST /auth/rest/public/authentication/goto-targets/retrieve HTTP/1.1
sec-ch-ua: "Chromium";v="152", "Not?A_Brand";v="24", "Google Chrome";v="152"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Accept: application/json
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cache-control: max-age=0
Cookie: CSRFT759-S=c0rElAszzZ7flx9F5ULPHQ; AL_SESS-S=AcAFRWo6WU9Z73W5VuGYk_K2F2LV3y0SCMhboxX7SsI9YaNL8d_MH!xkPliLWJ9X5zy6
Host: infoportal.baloise.de
X-Bug-Bounty: BBS:dwbzn
X-Same-Domain: 1
X-CSRFT759: c0rElAszzZ7flx9F5ULPHQ
Content-Length: 0
Content-Type: application/x-www-form-urlencoded
--- response (825 B application/json;charset=utf-8)
HTTP/1.1 200 OK
Date: Tue, 10 Nov 2026 13:58:59 GMT
Server: Apache
Content-Length: 99
Expires: 0
Last-Modified: Tue, 10 Nov 2026 13:58:59 GMT
Cache-Control: no-store, no-cache, must-revalidate
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
Permissions-Policy: accelerometer=(self), ambient-light-sensor=(self), autoplay=(self), camera=(self), display-capture=(self), document-domain=(self), encrypted-media=(self), fullscreen=(self), geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), midi=(self), payment=(self), usb=(self), xr-spatial-tracking=(self)
Content-Type: application/json;charset=utf-8

{"meta":{"type":"jsonapi.metadata.document","timestamp":"2026-11-10T14:58:59.041+01:00"},"data":[]}