Session Validate

Validate this protected user request. Control verifies current identity in PostgreSQL on every request. Only target-scoped permissions may be cached for at most 30 seconds; high risk always bypasses the cache. This is a breaking replacement for opaque session validation. Service access tokens are rejected. Support and delegation grants are not included. Cross-product access is allowed only for a confidential client registered with assistant.widget, an authorized platform mTLS caller, and a live immutable host login binding. product_id must name that host. A closed binding, closed host/SSO or changed host generation returns LOGIN_REQUIRED. Ordinary product audience isolation is unchanged.

POST https://id.test.globalbes.sg:9443/api/sessions/validate

Called byAll productsLegacy productsAssistant AuthService certificate+ signed-in user

Headers

DPoP

string

Required for DPoP; binds ath and the original HTTPS host/path and method, and is consumed once.

X-Original-Host

string

Original protected resource host supplied by the authenticated BFF/gateway; required for DPoP.

Body

product_id

uuid

Required for platform service accounts. For product services, omitted or equal to the registered product.

target*

object

context_id

uuid

Request preview

POST /api/sessions/validate

Response

Choose an API and send a request.

Caller tags:BOSSTenant adminAll productsMobile appMessagingControlAIAssistantPlatform opsLegacy productsCI release