---
title: "Start the WebPros authentication flow"
method: GET
path: "/360Monitoring/webpros_auth_start"
tags: ["360 Monitoring"]
---

# Start the WebPros authentication flow

`GET /360Monitoring/webpros_auth_start`

## Request

- Base URL: `https://whm-server.tld:2087/json-api`
- URL: `https://whm-server.tld:2087/json-api/360Monitoring/webpros_auth_start`
- Auth: HTTP basic

This function starts the WebPros single sign-on flow for 360 Monitoring.

The system records the user agent and the remote IP address in the
server's log only. It builds the redirect URI from the WHM session
identifier, which it reads from the request when the `session_id`
parameter is absent. The function fails when it cannot determine a
session identifier, because a redirect URI without one produces an
authentication flow that cannot complete.

The function returns an authorization URL and the state token for this
flow. Redirect the user to the authorization URL and store the state
token for the duration of the flow. When the user returns to the
server, pass the authorization code and the state that the identity
provider returned to the `360Monitoring/webpros_auth_callback`
function.

The system keeps the Proof Key for Code Exchange (PKCE) verifier on the
server, stored with the state for this flow. The verifier never reaches
the caller, and the `360Monitoring/webpros_auth_callback` function does
not accept one.

The state token is a single-use secret. Do not log it, and do not use
it outside of the WHM session that started the flow. The system binds
the flow to that session and rejects a callback that arrives under any
other session.

## Query parameters

- `session_id` string

## Response `200`

The HTTP Request succeeded.

- object
  - `data` object
    - `auth_url` string: The WebPros authorization URL. Redirect the user to this URL to complete the sign-in. The function only returns this field when it starts the flow successfully.
    - `error` string: The error message. The function only returns this field when the system failed to start the authentication flow.
    - `reason` string: The machine-readable failure code. The function returns this field for the failures that it detects before it starts the flow. The value is one of the following: * `missing_parameter` - The system could not determine the WHM session identifier. * `invalid_parameter` - The `session_id` parameter is not a number. A later failure sets `metadata.result` to `0` and returns `data.error` without this field.
    - `state` string: The state token for this flow. The system generates this value, stores it, and requires the `360Monitoring/webpros_auth_callback` function to return it unchanged. The token is single-use and expires ten minutes after the system issues it. The function only returns this field when it starts the flow successfully.
  - `metadata` object
    - `command` string: The method name called.
    - `namespace` string: The namespace used in the API call.
    - `reason` string: The reason the API function failed when the `metadata.result` field is `0`. This field may display a success message when a function succeeds.
    - `result` 0 | 1: * `1` - Success. * `0` - Failed. Check the `reason` field for more details.
    - `version` integer: The version of the API function.

## Changes

- **2026-09-23** `fe4906fbe393`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/cpanel/apis/whm-api/changes/360Monitoring/webpros_auth_start/get.md)

---

[API](https://skmtc.dev/cpanel/apis/whm-api.md) - [All operations](https://skmtc.dev/cpanel/apis/whm-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cpanel/apis/whm-api/revisions/6ca2c65397e3?raw)