Sessions

Mint Retrieval Token User

Browser-safe variant of POST /v1/sessions/token for logged-in users.

Authenticates with the caller's JWT (Authorization: Bearer <jwt>) and treats the X-API-Key header as the UUID id of one of the user's API keys — NOT the raw secret. Ownership is verified server-side (APIKeyModel.id == header AND user_id == jwt), so the raw secret never leaves the server. Mirrors POST /v1/filetag/user. Deliberately, the key's IP allowlist is NOT enforced on this path: the console runs from arbitrary user IPs, and JWT auth + server-side ownership is the control — the same accepted convention as /v1/filetag/user.

The minted token is identical to the server-to-server variant: signed, query-only, TTL-clamped, tenant pinned from the key.

post/api/v1/sessions/token/user

Request

  • Base URL: https://api.gemina.co (the document declares no server; this is the origin it was published from)
  • URL: https://api.gemina.co/api/v1/sessions/token/user
  • Auth: one of:
    • OAuth 2 (password, token URL token)
    • API key in header X-API-Key

Request body

endUserIdstring nullable

Optional end-user scope: the token will only see documents tagged to this end-user. Omit for an admin (whole-account) session.

ttlSecondsinteger nullable

Requested TTL; clamped server-side to [300, 900] seconds.

extractionIdsstring[] nullable

Optional extraction scope: the minted token may only read/verify these document-extraction ids (carried in the signed xids claim). Omit for the existing tenant / end-user scoping. Capped at 10; an empty list is rejected rather than silently minting a tenant-wide token.

Response

Successful Response

servedAtstring date-time
servedAtTimestampnumber
createdAtstring date-time nullable
createdAtTimestampnumber nullable
tokenstring required
tokenTypestring
expiresIninteger required
expiresAtstring date-time required

Changes

No recorded changes to this operation across all 1 revision of this API.