Skip to content

Sessions

Manage sessions and refresh access tokens for silent authentication and SSO across apps. These sessions apply to any of the authentication methods implemented using a backend-to-backend integration ('Backend Authentication').

Download OpenAPI description
backend-sessions.openapi.json
backend-sessions.openapi.yaml
Languages
Servers
Sandbox environment
https://api.sbx.transmitsecurity.io/cis
Production environment (US)
https://api.transmitsecurity.io/cis
Production environment (EU)
https://api.eu.transmitsecurity.io/cis
Production environment (CA)
https://api.ca.transmitsecurity.io/cis
Production environment (AU)
https://api.au.transmitsecurity.io/cis

Authenticate session

Request

Authenticates an existing session in order to obtain an access token without explicit user interaction. This enables silent authentication and single sign-on (SSO).

Security
ClientAccessToken
Bodyapplication/jsonrequired
resourcestring

Resource URI the authentication request is attempting to access, which is reflected in the audience (aud claim) of the access token. This must be configured as resource for the application.

claimsobject

Used to request additional claims in the ID token, such as roles, permissions, and other user profile data. The structure is per the OIDC Standard. For supported claims and how to request custom claims, see the ID Token Reference.

Example: {"id_token":{"roles":null}}
org_idstring

Organization ID, used for member login in B2B scenarios

client_attributesobject

Client attributes

session_idstringrequired

Authentication session ID returned by other backend methods.

curl -i -X POST \
  https://api.sbx.transmitsecurity.io/cis/v1/auth/session/authenticate \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "resource": "string",
    "claims": {
      "id_token": {
        "roles": null
      }
    },
    "org_id": "string",
    "client_attributes": {
      "user_agent": "string",
      "ip_address": "string"
    },
    "session_id": "string"
  }'

Responses

Returns user tokens

Bodyapplication/json
access_tokenstringrequired

User access token for accessing endpoints on behalf of the authenticated user.

id_tokenstring

ID token that identifies the user.

refresh_tokenstring

Refresh token used to refresh an expired access token.

token_typestringrequired

Bearer.

expires_innumberrequired

Expiration time of the access token in seconds.

Default 3600
session_idstringrequired

ID of the session in which the authentication occurs.

Response
application/json
{
  "access_token": "string",
  "id_token": "string",
  "refresh_token": "string",
  "token_type": "string",
  "expires_in": 3600,
  "session_id": "string"
}

Refresh access token

Request

Exchange the refresh token returned upon successful authentication for a new access token.

Required permissions: apps:execute, [appId]:execute, auth:execute.

Security
ClientAccessToken
Bodyapplication/jsonrequired
refresh_tokenstringrequired

Refresh token associated with the access token you want to refresh.

curl -i -X POST \
  https://api.sbx.transmitsecurity.io/cis/v1/auth/token/refresh \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "refresh_token": "string"
  }'

Responses

Returns user tokens

Bodyapplication/json
access_tokenstringrequired

User access token for accessing endpoints on behalf of the authenticated user.

id_tokenstring

ID token that identifies the user.

refresh_tokenstring

Refresh token used to refresh an expired access token.

token_typestringrequired

Bearer.

expires_innumberrequired

Expiration time of the access token in seconds.

Default 3600
Response
application/json
{
  "access_token": "string",
  "id_token": "string",
  "refresh_token": "string",
  "token_type": "string",
  "expires_in": 3600
}

Logout session

Request

Logs out the user by terminating the provided session.

Required permissions: apps:delete, [appId]:delete, sessions:delete.

Security
ClientAccessToken
Bodyapplication/jsonrequired
session_idstringrequired

ID of the session to log out.

curl -i -X POST \
  https://api.sbx.transmitsecurity.io/cis/v1/auth/session/logout \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "session_id": "string"
  }'

Responses

Get user sessions

Request

Retrieves all active sessions for a specified user.

Required permissions: apps:read, [appId]:read, sessions:read.

Security
ClientAccessToken
Path
userIdstringrequired

ID of the user to retrieve active sessions for

curl -i -X GET \
  'https://api.sbx.transmitsecurity.io/cis/v1/auth/users/{userId}/sessions' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Responses

Bodyapplication/jsonArray [
session_idstringrequired

Session ID

start_timestring(date-time)required

Session creation time

expiration_timestring(date-time)required

Session expiration time

]
Response
application/json
[
  {
    "session_id": "string",
    "start_time": "2019-08-24T14:15:22Z",
    "expiration_time": "2019-08-24T14:15:22Z"
  }
]

Revoke sessions

Request

Revokes all user sessions.

Required permissions: apps:delete, [appId]:delete, sessions:delete.

Security
ClientAccessToken
Path
userIdstringrequired

ID of the user to terminate active sessions for

curl -i -X DELETE \
  'https://api.sbx.transmitsecurity.io/cis/v1/auth/users/{userId}/sessions' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Responses

Sessions terminated