Authorization

Use a server-side API key with the listed grants and permitted resource access.

customer-sessions:create

Request headers

X-Api-Keyrequired: Your server-side integration credential.
Content-Typeapplication/json: Encode the request body as JSON.

Request body

subjectstring · required: Stable subject derived by your backend from its authenticated session.
scopesarray · required: The scopes values for this request.

Response

201Created

Returns the authorized resource or result for this operation. List results use items, nextCursor, and hasMore.

Behavior to account for

Derive subject from your authenticated server session. This endpoint cannot create identities or expand access. It requires customer-sessions:create and an explicit delegation policy. No renewal token is issued for tenant-owned login.

Errors

Authentication failures return 401 or 403. Inaccessible resources return 404. Business and idempotency conflicts return 409. Rate limits return 429 with retry guidance.

Error handling guide

curl --request POST 'https://api.wincora.com/api/v1/auth/customer-sessions' \ --header 'X-Api-Key: YOUR_API_KEY' \ --header 'Content-Type: application/json' \ --data '{ "subject": "user_7821", "scopes": [ "traveler:profile:read", "traveler:cases:read", "traveler:documents:write" ] }'

const response = await fetch('https://api.wincora.com/api/v1/auth/customer-sessions', { method: 'POST', headers: { "X-Api-Key": process.env.WINCORA_API_KEY, "Content-Type": "application/json" }, body: JSON.stringify({ "subject": "user_7821", "scopes": [ "traveler:profile:read", "traveler:cases:read", "traveler:documents:write" ] }) }); if (!response.ok) throw new Error(await response.text()); const result = await response.json();

import os import requests response = requests.request( 'POST', 'https://api.wincora.com/api/v1/auth/customer-sessions', headers={ "X-Api-Key": os.environ["WINCORA_API_KEY"], "Content-Type": "application/json" }, json={ "subject": "user_7821", "scopes": [ "traveler:profile:read", "traveler:cases:read", "traveler:documents:write" ] }, timeout=30, ) response.raise_for_status() result = response.json()