POST /internal_api/app_session_request
post_internal_api_app_session_request
Send appName and machineId, form or JSON, with no token and no cookie. The answer is a sessionRequestId to poll and a url a logged-in person opens in a browser to approve.
Step one of the App Session Launcher: the browser-approved login that a desktop client uses instead of
a password on a site whose logins belong to Autodesk Identity. Outside /api/v1, undocumented, and
advertised only by authentication_app_session_launcher_enabled in the root document (GET /).
A person has to approve it. Nothing a client sends here produces a token. The token is handed out by
PUT /internal_api/app_session_request/<sessionRequestId> after someone logged into the site in a
browser opens url and clicks approve.
Params
| part | value |
|---|---|
| path | <site>/internal_api/app_session_request, not under /api/v1 |
| auth | none. No Authorization, no cookie |
Content-Type |
application/x-www-form-urlencoded or application/json, both accepted |
appName |
required. The name shown to the person approving |
machineId |
required. Any string; the poll does not check it |
Sample requests
import requests
r = requests.post(f"{site}/internal_api/app_session_request",
data={"appName": "my tool", "machineId": platform.node()}, timeout=30)
{"sessionRequestId": "<id>", "url": "<site>/app_session_request/<id>?sticky_id=<id>"}
The same call with nothing in the body:
{"message": "Missing params: appName, machineId"}
Response codes
| status | when |
|---|---|
| 200 | the request exists; sessionRequestId and url are the only keys |
| 400 | Missing params: appName, machineId, or Missing params: machineId. Names every absent one |
| 404 | GET on this path. JSON:API envelope, code 103 |
Edge cases
- The error envelope is
{"message": ...}, not theerrors[]envelope every/api/v1call answers with. A client that readserrors[0].titlereads nothing here. urlopened without a site cookie answers 302 to the site's login page with the approval page asreturn_path, so the person logs in with whatever the site uses, Autodesk Identity included, and lands back on the approval.- A request nobody approves is forgotten after about five minutes (
052_app_session_launcher), so a client waiting on a person has to be ready to issue a new one and show the newurl. - On the probed site
user_authentication_methodisoxygen, so this is the only way a person, rather than a script, reaches the REST API there.