Is there a standard (actual or de facto) that says how a login endpoint of a web service should respond to different inputs?

Mastodon