Skip to main content
POST
Issue a tenant session

Authorizations

Authorization
string
header
required

An API key from your Devic console, sent as Authorization: Bearer <key>. An embedded front end sends a tenant-session token instead, so no API key reaches the browser, and an OAuth integration sends its access token. Missing, invalid or expired credentials get a 401. See Authentication.

Body

application/json
tenantId
string
required

The identity this session proves

Example:

"acme-corp"

subtenantId
string

Optional subtenant within the tenant

Example:

"acme-corp-eu"

ttlSeconds
integer
default:3600

Lifetime in seconds. Clamped into range, never rejected.

Required range: 60 <= x <= 43200

Response

Session issued

token
string

Send it as the bearer token from the browser

tokenType
string
Example:

"Bearer"

tenantId
string
subtenantId
string
expiresIn
integer

Seconds until it expires

expiresAt
integer<int64>

Epoch milliseconds