Skip to main content
POST
Consume a fresh code proof for a customer session

Authorizations

X-Customer-Auth-Intent
string
header
required

Original 256-bit client admission/replay secret, never a verification proof.

X-Customer-Challenge
string
header
required

Purpose-limited challenge capability, paired with the original intent secret.

Headers

Idempotency-Key
string
required

Caller-stable key reused only for retries of this exact request.

Required string length: 16 - 128
Pattern: ^[A-Za-z0-9._:-]{16,128}$

Path Parameters

merchantSlug
string
required
Required string length: 1 - 128
challengeId
string
required
Required string length: 1 - 128

Body

application/json
code
string
required
Required string length: 1 - 128

Response

Opaque customer session grant; no provider identity is exposed.

sessionId
string<uuid>
required
Pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$
customerId
string<uuid>
required
Pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$
generation
integer
required
Required range: 0 < x <= 9007199254740991
accessExpiresAt
string<date-time>
required
Pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$
refreshExpiresAt
string<date-time>
required
Pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$
accessToken
string
required
Pattern: ^[a-f0-9]{64}$
refreshToken
string
required
Pattern: ^[a-f0-9]{64}$