GET and POST /auth/session

Part of the API reference; this page is generated from the OpenAPI document that the gateway builds from its own route tables.

Provenance

• Contract version: 1.10.0
• Contract title: acumen gateway API
• Source: acumen:docs/openapi/acumen-v1.openapi.json

Operations

GET /auth/session

Console session bootstrap — who am I

Returns the authenticated operator’s key id, fingerprint, scopes, a fresh CSRF token and the session expiry. Used by the console shell and by scripts that drive the console API.

• Operation id: getAuthSession
• Scope: none
• Exposure: operator
• Mutating: no

Responses

• 200: the current session
  • application/json: AuthSession: AuthSession (object)
• 401: auth_session — no valid operator session
  • application/problem+json: Problem: Problem (object)

POST /auth/session

Console login — exchange a virtual key for a session

Accepts an admin or ops:read virtual key and mints the signed acumen_session cookie plus a CSRF token. The body is JSON (key); the token is never echoed. Loopback-only: a disabled or non-loopback console answers 404. The console pages are server-rendered and use this cookie.

• Operation id: postAuthSession
• Scope: none
• Exposure: operator
• Mutating: yes

Request

• Request body (application/json, required): AuthLoginRequest: AuthLoginRequest (object)

Field	Type	Required	Notes
key	string	yes

Responses

• 200: session minted; Set-Cookie acumen_session
  • application/json: AuthSession: AuthSession (object)
• 400: schema_invalid — body must be JSON with a key field
  • application/problem+json: Problem: Problem (object)
• 401: auth_session — the key is unknown, inactive or lacks admin/ops:read
  • application/problem+json: Problem: Problem (object)
• 404: console disabled or non-loopback listener
  • application/problem+json: Problem: Problem (object)