Sessions
Obtaining, inspecting and ending a credential.
| Operation | Auth | Purpose |
|---|---|---|
POST /api/session | — | Log in with a user name and password (SRP), and receive a bearer credential. |
DELETE /api/session | — | End a session. Idempotent. |
POST /api/session/certificate/challenge | — | Certificate login, leg 1: present a certificate and receive 32 bytes to sign. |
POST /api/session/certificate | — | Certificate login, leg 2: answer the challenge and receive a bearer credential. |
POST /api/session/delegated | Bearer + DPoP | Mint a session acting as an externally-authenticated principal. Guarded. |
POST /api/session/scoped | Bearer + DPoP | Mint a short-lived, object-scoped, key-bound credential for a browser. Guarded. |
GET /api/session/scoped | Bearer + DPoP | Report the object scope of the calling session, if it has one. |
POST /api/session/scoped/revoke | Bearer + DPoP | Kill a scoped credential before it expires. |