Skip to main content
POST
Portal SSO token-bearer exchange

Body

application/json
code
string
required

Short-lived authorization code issued by the portal

spoof
string<uuid>

Optional company UUID to impersonate. Must be a valid UUID; Core authorizes the impersonation.

Response

Session minted. The token is the bearer session ID; send it as Authorization: Bearer <token> on subsequent requests.

token
string
required

Opaque session ID

expiresAt
string<date-time>
required

Session deadline at mint time. Rolling: it moves forward on every successful renewal (POST /api/auth/session/renew), so a live client's real expiry drifts past this value. Never a hard cap.

idleTimeoutSeconds
integer
required

Sliding idle window measured against the session's last activity. Default 25200 (7h). Independent of absoluteMaxAgeSeconds — either can force re-auth first.

absoluteMaxAgeSeconds
integer
required

Rolling session lifetime in seconds (SESSION_LIFETIME, default 86400). Re-set at creation and on every renewal, so this is the size of the rolling window, not an absolute cap. The wire key stays absoluteMaxAgeSeconds for portal compatibility.

user
object
required
organization
object
required

Effective tenant — the spoof target when spoofing, otherwise the user's own company.