Sessions

A session is a logged in period where a user, associated with a user tag, can make authenticated requests to the API. Sessions expire after a time, and attempted requests made with an expired session will result in an error. Sessions also auto-renew with use, so as long as a user is using their session regularly, its expiration date will be extended.

The session object

Attribute	Type	Description
id	uuid	The unique identifier of the session.
user_tag	string	The user tag associated with the session.
token	token	The session token, a prefixed UUID. Returned only when the session is created.
expiration_date	datetime	The datetime when the session expires.
created_at	datetime	The datetime for when the session was created.

{
  "id": "f59baf09-c53c-4252-af1c-3c790362ba36",
  "user_tag": "a9f201c2-36eb-41e1-b30a-7bd180f02e91",
  "expiration_date": "2026-07-15T18:40:00Z",
  "created_at": "2026-07-15T18:40:00Z"
}

The token is returned only in the response to creating a session (below) — it is not included when a session is read or listed.

Creating a session

POST https://api.cxipgroup.com/sessions
Admin token required

To create a session, send an authenticated request to the above endpoint naming the user it belongs to. POST /sessions/new is also accepted as an alias.

Parameters:

Parameter	Value	Description
user_tag	uuid (required)	The user tag the session is minted for. It must be one of your own user tags.

Request:

curl

curl -i "https://api.cxipgroup.com/sessions" \
  -X POST \
  -H "Authorization: Bearer adtk_607981a4-8946-4148-8974-ee9b4236991f" \
  -H "Content-Type: application/json" \
  -d '{
    "user_tag": "a9f201c2-36eb-41e1-b30a-7bd180f02e91"
  }'

JavaScript

const response = await fetch("https://api.cxipgroup.com/sessions", {
  method: "POST",
  body: JSON.stringify({
    user_tag: "a9f201c2-36eb-41e1-b30a-7bd180f02e91"
  }),
  headers: {
    "Content-type": "application/json; charset=UTF-8",
    "Authorization": "Bearer adtk_607981a4-8946-4148-8974-ee9b4236991f"
  },
});

Response:

{
  "id": "6f2bd2cb-3ca5-47bd-a680-64cd7cd11312",
  "user_tag": "a9f201c2-36eb-41e1-b30a-7bd180f02e91",
  "token": "ustk_80573e65-c815-49d8-b7b9-75cf2f143876",
  "expiration_date": "2026-07-15T18:40:00Z",
  "created_at": "2026-07-15T18:40:00Z"
}

Status codes:

Status	When
201 Created	The session was minted. The body carries the token, returned only here.
401 Unauthorized	Missing or invalid token.
403 Forbidden	The token is not an admin (adtk_) token.
422 Unprocessable Content	The user_tag is missing, or names no tag belonging to your client.

Listing a user's sessions

GET https://api.cxipgroup.com/sessions
Admin token required

PLANNED

Listing sessions is not yet available. This section describes a planned endpoint.

To list the sessions belonging to a user, send an authenticated request to the above endpoint with the user's user_tag as a query parameter. The response is a bare array of session objects.

Parameters:

Parameter	Value	Description
user_tag	uuid (required)	The user tag whose sessions you want to list.

Request:

curl

curl -i -G "https://api.cxipgroup.com/sessions" \
  -H "Authorization: Bearer adtk_c1f4e2a7-9b3d-4e6a-8f21-0a5c7d9e1b34" \
  --data-urlencode "user_tag=<the user's tag>"

JavaScript

const response = await fetch("https://api.cxipgroup.com/sessions?user_tag=<the user's tag>", {
  method: "GET",
  headers: {
    "Content-type": "application/json; charset=UTF-8",
    "Authorization": "Bearer adtk_c1f4e2a7-9b3d-4e6a-8f21-0a5c7d9e1b34"
  },
});

Response:

[
  {
    "id": "f59baf09-c53c-4252-af1c-3c790362ba36",
    "user_tag": "a9f201c2-36eb-41e1-b30a-7bd180f02e91",
    "expiration_date": "2026-07-15T18:40:00Z",
    "created_at": "2026-07-15T18:40:00Z"
  },
  {
    "id": "6f2bd2cb-3ca5-47bd-a680-64cd7cd11312",
    "user_tag": "a9f201c2-36eb-41e1-b30a-7bd180f02e91",
    "expiration_date": "2026-07-15T18:40:00Z",
    "created_at": "2026-07-15T18:40:00Z"
  }
  // ...
]

Status codes:

Status	When
200 OK	The body is a bare array of sessions, without their tokens.
401 Unauthorized	Missing or invalid token.
403 Forbidden	The token is not an admin (adtk_) token.
422 Unprocessable Content	The user_tag is missing, or names no tag belonging to your client.