Establish or renew an Atoti browser session.
Call on the portal origin with a supported JWT in the Authorization Bearer header and a matching Origin header. API keys and URL tokens are rejected. The real user’s enabled organisation and browser IP admission are checked using the existing permission pipeline. Issues a host-only, HttpOnly, Secure, SameSite=Strict cookie scoped to /atoti, without sliding renewal. The session retains the admitted identity and permission inputs, omitting unrelated identity-provider metadata to avoid oversized browser cookies. Its UTC expiry never exceeds the JWT expiry. Renewal does not extend already-open sockets or streams. No user or organisation fields are accepted. The response contains only the expiry and relative UI path; unavailable identity services fail closed. Local MacDevelopment retains the existing IP admission exception.
Authorizations
An existing browser JWT in the Authorization header as Bearer . API keys and URL tokens are not accepted.
Response
The session was established; returns its UTC expiry and organisation-relative UI path.
Describes the authenticated user's short-lived browser session for their organisation's Atoti UI.
Derivitec.Web.Core.Atoti.AtotiSessionResponse, Derivitec.Web.Core UTC instant when the browser cookie expires, no later than the validated bearer JWT expiry; renew using a current bearer token before this instant.
"2026-10-08T12:00:00Z"
Server-resolved relative UI path for the authenticated organisation on the current portal origin, including the trailing slash; never an upstream service URL.
"/atoti/example-organisation/"