Session Tenant List

Lists current authorized tenant/project choices. Confidential Web clients do not require DPoP; native clients still require token-bound DPoP. A widget request also authenticates a platform service with mTLS and requires product_id equal to its bound host. A closed host or changed generation returns LOGIN_REQUIRED; host re-login never revives the old widget. Refresh never changes the binding. Lists active membership and tenant with an effective product entitlement. Project products list only active authorized projects; tenant products return an empty projects array. MFA is computed from staff/customer and tenant policy without creating or consuming a challenge.

GET https://id.test.globalbes.sg:9443/api/sessions/tenants

Called byMobile appAll productsAssistant Authuser-bearermtls-service-identity+user-bearer

Query

product_id

uuid

Host product for a registered widget client and authenticated platform service. Must match the immutable host login binding. Ordinary product clients omit this parameter.

Headers

DPoP

string

Native clients require a DPoP proof bound to this endpoint method, issuer URL and ath; each proof is consumed once.

Request preview

GET /api/sessions/tenants

Response

Choose an API and send a request.

Caller tags:BOSSTenant adminAll productsMobile appMessagingControlAIAssistantPlatform opsLegacy productsCI release