Read Session
Request and response reference for GET /api/auth/session.
/api/auth/sessionRequest
This interface uses an approved institutional session, not a financial API key. Session writes also need Origin and CSRF protection. Use the JavaScript sample within an authorized browser integration.
curl -X GET "$OSAI_CONSOLE_BASE_URL/api/auth/session" \
-H "Origin: $OSAI_APP_ORIGIN" \
--cookie "$OSAI_SESSION_COOKIE_FILE"Parameters
No endpoint-specific path or query parameters are defined. Authentication and access policy still apply.
Request body
This operation does not define a JSON request body.
Responses
Inspect HTTP status before parsing a body. These tables describe client response fields rather than invented successful transaction payloads.
200 · HTTP 200 response
| Field | Type | Description & constraints |
|---|---|---|
membershipRequired in parent object | object | Defined by the resource contract. |
membership.membership_idRequired in parent object | string | Defined by the resource contract. |
membership.institution_idRequired in parent object | string | Defined by the resource contract. |
membership.provider_idRequired in parent object | string | Defined by the resource contract. |
membership.issuerRequired in parent object | string | Defined by the resource contract. |
membership.subjectRequired in parent object | string | Defined by the resource contract. |
membership.display_nameRequired in parent object | string | Defined by the resource contract. |
membership.role_idsRequired in parent object | array | Defined by the resource contract. |
membership.statusRequired in parent object | string | Defined by the resource contract.Values: ACTIVE, SUSPENDED |
membership.versionRequired in parent object | string | Exact nonnegative base-10 integer; never a JSON number.Pattern: ^(0|[1-9][0-9]*)$ |
effective_permissionsRequired in parent object | array | Defined by the resource contract. |
mfa_verifiedRequired in parent object | boolean | Defined by the resource contract. |
auth_timeRequired in parent object | stringdate-time | Defined by the resource contract. |
created_atRequired in parent object | stringdate-time | Defined by the resource contract. |
expires_atRequired in parent object | stringdate-time | Defined by the resource contract. |
last_seen_atRequired in parent object | stringdate-time | Defined by the resource contract. |
policy_idRequired in parent object | string | Defined by the resource contract. |
policy_versionRequired in parent object | string | Exact nonnegative base-10 integer; never a JSON number.Pattern: ^(0|[1-9][0-9]*)$ |
400 · Invalid bounded instruction
No client body fields are defined for this response.
401 · Authentication required
No client body fields are defined for this response.
403 · Permission, recent verified MFA or CSRF denied
No client body fields are defined for this response.
409 · Version, preview, instruction or capacity conflict
No client body fields are defined for this response.
503 · Unavailable or unknown commit outcome; query the original command before retrying
No client body fields are defined for this response.
Retries & recovery
Keep the original request identifiers and any required idempotency key. A timeout does not establish failure. Read the original resource or command before another financial write; use expected versions for concurrent changes.