> ## Documentation Index > Fetch the complete documentation index at: https://docs.activeviam.com/llms.txt > Use this file to discover all available pages before exploring further. # Establish or renew an Atoti browser session. > Call on the portal origin with a supported JWT in the Authorization Bearer header and a matching Origin header. API keys and URL tokens are rejected. The real user's enabled organisation and browser IP admission are checked using the existing permission pipeline. Issues a host-only, HttpOnly, Secure, SameSite=Strict cookie scoped to /atoti, without sliding renewal. The session retains the admitted identity and permission inputs, omitting unrelated identity-provider metadata to avoid oversized browser cookies. Its UTC expiry never exceeds the JWT expiry. Renewal does not extend already-open sockets or streams. No user or organisation fields are accepted. The response contains only the expiry and relative UI path; unavailable identity services fail closed. Local MacDevelopment retains the existing IP admission exception. ## OpenAPI ````yaml /risk-and-pricing/atoti-risk-services/apis-endpoints/openapi/openapi.mintlify.json post /atoti/session openapi: 3.0.4 info: title: Derivitec Api 1.0 version: '1.0' servers: - url: https://api.riskportal.activeviam.com security: - oauth2: [] - apikey: [] tags: - name: AdminUser - name: AtotiReport - name: AtotiSession - name: BloombergOAuth - name: Bond - name: BondYieldCurvePage - name: BookAccess - name: Books - name: Commodity - name: Counterparties - name: Currencies - name: Equity - name: EquityDividend - name: EquityPage - name: FeatureFlag - name: Fx - name: FxPage - name: GroupAccess - name: Home - name: LegacyPosition - name: MarketData - name: MarketDataProvider - name: MarketDataProviderAccess - name: Meta - name: Notification - name: Organisation - name: PnLReport - name: PortfolioAccess - name: Portfolios - name: Position - name: PositionFilter - name: PricingEnvironment - name: PricingEnvironmentAccess - name: RateAsset - name: RateAssetPage - name: Report - name: ReportDefinition - name: ReportHistoryLauncherQuery - name: ReportLauncher - name: ReportQuery - name: ReportQueryViewUser - name: ReportRestriction - name: ReportView - name: RiskReport - name: Tradable - name: TradeBooking - name: User - name: VarReport - name: VarReportQuery - name: YieldCurvePage paths: /atoti/session: post: tags: - AtotiSession summary: Establish or renew an Atoti browser session. description: >- Call on the portal origin with a supported JWT in the Authorization Bearer header and a matching Origin header. API keys and URL tokens are rejected. The real user's enabled organisation and browser IP admission are checked using the existing permission pipeline. Issues a host-only, HttpOnly, Secure, SameSite=Strict cookie scoped to /atoti, without sliding renewal. The session retains the admitted identity and permission inputs, omitting unrelated identity-provider metadata to avoid oversized browser cookies. Its UTC expiry never exceeds the JWT expiry. Renewal does not extend already-open sockets or streams. No user or organisation fields are accepted. The response contains only the expiry and relative UI path; unavailable identity services fail closed. Local MacDevelopment retains the existing IP admission exception. operationId: Create responses: '200': description: >- The session was established; returns its UTC expiry and organisation-relative UI path. content: application/json: schema: $ref: '#/components/schemas/AtotiSessionResponse' '400': description: BadRequest '401': description: >- The Authorization Bearer token is missing, invalid or expired, or its expiry is unavailable. content: application/json: schema: $ref: '#/components/schemas/ProblemDetails' '403': description: >- The host, origin, user, organisation enablement or IP admission was denied. content: application/json: schema: $ref: '#/components/schemas/ProblemDetails' '503': description: >- The identity admission service is unavailable; no session was issued. security: - atotiBrowserBearer: [] components: schemas: AtotiSessionResponse: required: - $type type: object properties: expiresAt: type: string description: >- UTC instant when the browser cookie expires, no later than the validated bearer JWT expiry; renew using a current bearer token before this instant. format: date-time example: '2026-10-08T12:00:00Z' uiUrl: type: string description: >- Server-resolved relative UI path for the authenticated organisation on the current portal origin, including the trailing slash; never an upstream service URL. nullable: true example: /atoti/example-organisation/ $type: type: string enum: - Derivitec.Web.Core.Atoti.AtotiSessionResponse, Derivitec.Web.Core additionalProperties: false description: >- Describes the authenticated user's short-lived browser session for their organisation's Atoti UI. ProblemDetails: type: object properties: type: type: string nullable: true title: type: string nullable: true status: type: integer format: int32 nullable: true detail: type: string nullable: true instance: type: string nullable: true additionalProperties: false securitySchemes: oauth2: type: oauth2 description: >- OAuth2 access-token requested from AWS Cognito and provided as a Auth Bearer header flows: implicit: authorizationUrl: https://auth.riskportal.derivitec.com/oauth2/authorize scopes: {} apikey: type: apiKey description: API-Key requested via the site and provided as a header name: x-api-key in: header atotiBrowserBearer: type: http description: >- An existing browser JWT in the Authorization header as Bearer . API keys and URL tokens are not accepted. scheme: bearer bearerFormat: JWT ````