---
title: "Open a viewer session for an org-only or private Composal Pages site"
method: POST
path: "/api/v1/com_site_access/sessions"
tags: ["com_site_access"]
---

# Open a viewer session for an org-only or private Composal Pages site

`POST /api/v1/com_site_access/sessions`

## Request

- Base URL: `https://composal.com` (the document declares no server; this is the origin it was published from)
- URL: `https://composal.com/api/v1/com_site_access/sessions`
- Auth: HTTP bearer

For signed-in Composal clients such as the desktop browser. The client stores session_token as the site's host-only cookie named cookie_name. Agent runtime tokens are refused.

## Request body

- object
  - `host` string, required: Site hostname, for example docs.acme.composal.page

## Response `200`

Viewer session for the site

- object
  - `session_token` string, required
  - `cookie_name` string, required
  - `max_age` integer, required

## Other responses

- `401`: Not signed in
- `403`: The signed-in user cannot view the site, or the caller is an agent
- `404`: Unknown site
- `422`: The site is public and needs no sign-in

---

[API](https://skmtc.dev/composal/apis/vex-api.md) - [All operations](https://skmtc.dev/composal/apis/vex-api/llms.txt) - [OpenAPI document](https://skmtc.dev/composal/apis/vex-api/revisions/74298a24e040?raw)