Custom Function authentication and POST method

@Pavel_Duchovny Thank you very much for your answer!
I just did a test run, and it’s not really necessary to create a Webhook for authentication like I did.
If I understand correctly the last parameter of the url must be “login” and not the name of the authentication function (“login” is directly associated to the custom authentication function). Right?
When I did a test, I received this data as answer: “access_token”, “refresh_token”, “user_id” and “device_id”.
Where can I find information about the use of these values? I only managed to understand that “user_id” refers to the value of the “_id” field in the db document that refers to the user.
Moreover I have noticed that the “device_id” field is always the same as “00000000000000000000”. I don’t know if this is normal or if I need to do some specific operation to fill the field correctly.