Endpoints — Other

POST /internal_api/autodesk_identity/license_renewal

Renews the Autodesk Identity licence lease behind the _session_id cookie: {"message": "OK"} and license.expiresAt moves to now plus one day. 401 without the cookie.

• It also moves the session's own expiresAt, so one call renews both clocks.

• Whether a REST bearer can still be minted once license.expiresAt has passed while the session is alive is not measured. On the probed site the licence lease started at the person's browser login and the session at the approval, so the licence is the one that runs out first.

• Only measured on a site whose user_authentication_method is oxygen. What it answers on a site without Autodesk Identity is not measured.

Measured by

• 052_app_session_launcher (findings) — Post appName and machineId, open url in a browser, PUT the id until approved. The sessionToken spends at grant_type=session_token as that person, and every mint renews the session.
  rules: doors/findings-auth

corpus/endpoints/post_internal_api_autodesk_identity_license_renewal.md

GET /internal_api/session

With the session token as the _session_id cookie, answers when the session and the licence lease expire, in epoch seconds. Reading it does not renew anything. 401 without the cookie.

• Timestamps are epoch seconds. On the probed site expiresAt - createdAt is 86400 on both app and license, which is the site's User Session Expiry preference reading one day, and notifyAt is expiresAt - 900.

• expiresAt is a sliding window, and this call does not slide it. Two reads five seconds apart return the same value. What moves it is any spend of the session token: POST /auth/access_token with grant_type=session_token, POST /internal_api/session, or the licence renewal (052_app_session_launcher). A mint moves it only when the last move was 300s or more ago; the two POST renewals move it every time.

• license is the Autodesk Identity seat lease, separate from the session and renewed separately by POST /internal_api/autodesk_identity/license_renewal. expirationReason names which of the two the top-level expiresAt reports.

• The error envelope is {"message": ...}, as on every /internal_api call, not the errors[] array.

Measured by

• 052_app_session_launcher (findings) — Post appName and machineId, open url in a browser, PUT the id until approved. The sessionToken spends at grant_type=session_token as that person, and every mint renews the session.
  rules: doors/findings-auth
• 062_cors (findings) — Every path under /api/v1 answers the preflight and echoes any Origin, credentials true. /internal_api and the web paths send no CORS header, so a page on another origin proxies those.
  rules: doors/findings-protocol

corpus/endpoints/get_internal_api_session.md

POST /internal_api/session

Renews the session behind the _session_id cookie: {"message": "OK"} and expiresAt moves to now plus the site's expiry window. 401 without the cookie.

• It is not needed to keep a REST client alive: minting a bearer with grant_type=session_token moves expiresAt by the same amount, recorded at most once every 300s (052_app_session_launcher). It is the call for a client that holds a session token and has nothing to mint for a while.

• The web app calls it only when the page saw input in the last three minutes; a client renewing on a timer keeps a session alive indefinitely, which is the behaviour the site's User Session Expiry preference exists to bound. Renew on use, not on a clock.

Measured by

• 052_app_session_launcher (findings) — Post appName and machineId, open url in a browser, PUT the id until approved. The sessionToken spends at grant_type=session_token as that person, and every mint renews the session.
  rules: doors/findings-auth
• 062_cors (findings) — Every path under /api/v1 answers the preflight and echoes any Origin, credentials true. /internal_api and the web paths send no CORS header, so a page on another origin proxies those.
  rules: doors/findings-protocol

corpus/endpoints/post_internal_api_session.md