Session.Create

Try it in Swagger

Legacy-compatible login. Prefer Auth/Token for new integrations. Send the API key in the X-Api-Key header — not as clientCode. See Authentication.

Endpoint

Method: POST
Route: Session/Create
Authentication: Anonymous

This endpoint does not require Authorization: Bearer {token}. The returned sessionGuid is a JWT used on subsequent authorized requests.

Request Schema

Headers

Header	Required	Notes
`X-Api-Key`	Required when tenant is not resolved by subdomain	The long hex API key. Resolves the tenant. Do not put this value in `clientCode`.

JSON Body

Body type: SessionTokenRequest

Field	Type	Required	Notes
`clientCode`	`string?`	No	Short tenant code (for example `TRISTAR`). Optional when `X-Api-Key` is present. If sent, it must match the tenant the key belongs to.
`userId`	`string`	Yes	Contact email in the tenant database.
`password`	`string`	Yes	Contact password in the tenant database.

Request Sample

POST /Session/Create
Content-Type: application/json
X-Api-Key: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef

{
  "userId": "contact@example.com",
  "password": "your-password"
}

Expected Response Schema

Status Codes

Status	Notes
`200 OK`	Returned by the controller for this operation.
`404 Not Found`	Requested resource or draft was not found.

Success Body

Response type: object

The response body mirrors the session token shape returned by SessionController.Create.

Response Sample

{
  "clientCode": "ABC001",
  "userId": "api.user@example.com",
  "password": "",
  "sessionGuid": "jwt-or-session-token",
  "tokenType": "Bearer",
  "expiresInMinutes": 60
}