---
title: "Bootstrap Goal Browser Session"
method: GET
path: "/goals/session"
tags: ["goals"]
---

# Bootstrap Goal Browser Session

`GET /goals/session`

Create or refresh this browser's goals session; hand back its CSRF token.

The page's first call, and its call again after a reload — the CSRF token
lives in memory, so asking again is how the page gets back the right to take
a turn on a conversation it already owns. Asking again returns the *same*
token, so a second tab does not take that right away from the first (#1883).

## Response `200`

Successful Response

- GoalBrowserSessionResponse — What ``GET /goals/session`` hands the page back. Deliberately thinner than the Routes equivalent: the goals page has no session list to render and no route ancestry to carry, so it gets the two things it actually acts on — the CSRF token every turn must echo, and when the session stops being valid so it knows to bootstrap again. The session id rides along because it is what an operator matches a stored conversation on; it authorizes nothing on its own (the cookie does).
  - `session_id` string, required
  - `expires_at` string, date-time, required
  - `csrf_token` string, required

---

[API](https://skmtc.dev/imperfect/apis/imperfect-api.md) · [All operations](https://skmtc.dev/imperfect/apis/imperfect-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/imperfect/imperfect-api/revisions/cc2293a44257/schema)