GET/auth

Get Session Token

Exchange a signed JWT for a SessionToken. Sign a short-lived HS256 JWT with your ClientSecret and send it via x-auth-token header. The returned SessionToken must be used as the session-token header on all secured endpoints.

Headers

Field	Type	Required	Possible values	Description
`x-auth-token`	string	Required	—	HS256 JWT signed with your ClientSecret. Payload must include ClientID, iat (issued at), and exp (expiry).
`x-broker-ip`	string	Optional	—	Client IP address for request tracing.

Response

Field	Type	Possible values	Description
`ResponseCode`	integer	200 \| 201 \| 204 \| 301 \| 400 \| 401 \| 403 \| 404 \| 410 \| 422 \| 500 \| 503	API result code in the response envelope. Indicates success or the error category (e.g. 200 success, 400 bad request, 401 unauthorized).
`ResponseMessage`	string	Success \| Created \| NoContent \| BadRequest \| Unauthorized \| Forbidden \| NotFound \| Gone \| UnprocessableContent \| ServerError \| ResourceMoved \| ServiceUnAvailable \| UnProcessableEntity	Human-readable label paired with ResponseCode (e.g. Success, BadRequest, Unauthorized). Use with ResponseCode to interpret the outcome.
`ResponseData`	object	Please refer to below example for response body	Session token to authenticate all secured endpoints. Pass as session-token header.

Example response

{
  "ResponseCode": 200,
  "ResponseMessage": "Success",
  "ResponseData": {
    "SessionToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJDbGllbnRJRCI6ImE4ZjNjMWQyLTdiOWUtNGY2YS05MmQxLTNjNWU4YjdhMWY5MCIsImlhdCI6MTYzNzgzNjg4MiwiZXhwIjoxNjM3ODM5ODgyfQ.abc123"
  }
}

{
  "ResponseCode": 200,
  "ResponseMessage": "Success",
  "ResponseData": {
    "SessionToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJDbGllbnRJRCI6ImE4ZjNjMWQyLTdiOWUtNGY2YS05MmQxLTNjNWU4YjdhMWY5MCIsImlhdCI6MTYzNzgzNjg4MiwiZXhwIjoxNjM3ODM5ODgyfQ.abc123"
  }
}

The SessionToken must be sent as the session-token header on all secured endpoints.

Note that calls to secured endpoints require the same IP address that was used to obtain the session token.