You are on the right track with the login endpoint, check this post out: Build a Rest API - #5 by chris.williamson1996
As a bonus if you want to log the user out after a custom duration (before 1 year) you can schedule the log out workflow for another date right after logging in.