Skip to main content
POST
Create Session

Authorizations

Authorization
string
header
required

Bearer scheme name used by typed customer admin operations.

Body

application/json

API-key or workload-identity session request.

session_ttl_seconds
integer<int32> | null

Requested session TTL in seconds. Must be between 300 and 3600. Defaults to 900 (15 minutes) when omitted.

Required range: 300 <= x <= 3600
Example:

900

source_ip
string | null

Optional client-reported source IP, recorded for audit.

Maximum string length: 128
user_agent
string | null

Optional client-reported user agent, recorded for audit.

Maximum string length: 512

Response

Session minted

Response body for POST /v1/admin/sessions.

session_token is shown once; Mount Thor stores only its SHA-256 digest.

audience
string
required

API audience the session token is valid for.

Example:

"api.mountthor.com"

customer_id
string<uuid>
required

Customer account id the session is bound to.

customer_user_id
string<uuid>
required

Customer principal id the session is bound to.

expires_at
string
required

RFC 3339 timestamp at which the session token expires.

Example:

"2026-05-06T18:30:00Z"

issued_at
string
required

RFC 3339 timestamp at which the session token was issued.

Example:

"2026-05-06T18:15:00Z"

namespace_name
string
required

Tenant namespace inside the customer's dedicated control plane.

scopes
string[]
required

Scopes granted to the session.

Example:
session_id
string<uuid>
required

Stable Mount Thor identifier for the minted session.

session_token
string
required

Short-lived bearer token. Format: mt_session_*. Returned exactly once.

Example:

"mt_session_01JZ8M7EXAMPLE"

session_ttl_seconds
integer<int32>
required

Granted session TTL in seconds.

tenant_id
string<uuid>
required

Tenant id the session is bound to.

token_type
string
required

Always "Bearer".

Example:

"Bearer"

refresh_token
string | null
refresh_token_expires_at
string | null

RFC 3339 timestamp at which the refresh token expires (when set).

refresh_token_ttl_seconds
integer<int32> | null

Refresh token TTL in seconds (when refresh_token is set).