---
title: "Sign in with a saved login without seeing it"
method: POST
path: "/api/run/open_session"
---

# Sign in with a saved login without seeing it

`POST /api/run/open_session`

## Request

- Base URL: `https://vault.cloudforbots.com`
- URL: `https://vault.cloudforbots.com/api/run/open_session`
- Auth: one of:
  - none
  - HTTP bearer

Sign in with a saved login without seeing it. The server fills {{username}}, {{password}} and {{totp}} into your form, posts it to url (https, inside the login's allowed hosts), keeps the cookies encrypted, and returns an opaque session id. Checked against the login's scope and daily cap; logged to the audit log. If the site shows a CAPTCHA or new-device check, the reply suggests next_step request_human (Human Handoff relay). Free watch-only logs would_use_vault and signs in nowhere.

## Request body

- object
  - `name` string, required: Saved login name.
  - `url` string, required: The sign-in endpoint, e.g. https://example.com/session.
  - `form` object: Fields to send, values may use {{username}}, {{password}}, {{totp}}. Default {"username":"{{username}}","password":"{{password}}"}.
  - `as` 'form' | 'json': Body encoding. Default form.
  - `method` 'POST' | 'PUT': Default POST.
  - `prefetch` boolean: GET the url first to pick up CSRF cookies. Default true.

## Response `200`

Result with job, understood, outcome, usage

- object

## Other responses

- `401`: bad_agent_key
- `429`: free_limit_reached (includes upgrade link)

---

[API](https://skmtc.dev/cloudforbots/apis/login-vault.md) · [All operations](https://skmtc.dev/cloudforbots/apis/login-vault/llms.txt) · [OpenAPI document](https://skmtc.dev/cloudforbots/apis/login-vault/revisions/4b2f0405fb74?raw)