Session Tenant Selection Start

Confidential web clients create a five-minute selection bound to user, current SSO and token sid. A newer pending selection revokes the old one for the same sid. Pages require matching Person and SSO plus CSRF. No login or token is created. Without SSO, the registered callback receives error=login_required and the product must initiate OIDC login then start a new selection. The selector alone never authenticates the user.

POST https://id.test.globalbes.sg:9443/api/sessions/tenant-selection

Called byAll products AuthService certificate+ signed-in user

Headers

DPoP

string

Native clients require a DPoP proof bound to this endpoint method, issuer URL and ath; each proof is consumed once.

Body

continue_url*

string

Must equal a redirect_uri or post_logout_redirect_uri of this token client exactly.

Request preview

POST /api/sessions/tenant-selection

Response

Choose an API and send a request.

Caller tags:BOSSTenant adminAll productsMobile appMessagingControlAIAssistantPlatform opsLegacy productsCI release