---
title: "Console Session"
method: POST
path: "/api/v1/console/session"
tags: ["console"]
---

# Console Session

`POST /api/v1/console/session`

## Request

- Base URL: `https://ndi-api.nace.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://ndi-api.nace.ai/api/v1/console/session`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/nace/apis/ndi-service/docs/api/v1/console/session/post.ts> (a function with typed inputs; its response is checked against the schema)

Sign in: resolve the identity and report where it may work.

A cloud identity that belongs nowhere and still has free allowance is given
one ordinary organization to own, so the console has something to select and
the first visit is not a dead end. Signing in still mints no key: the key the
browser uses is short-lived and asked for separately, once an organization is
on screen. On-premise, and once the allowance is spent, zero organizations
remains a normal answer and the console offers to create one.

## Response `200`

Returning sign-in — nothing was written.

- ConsoleSessionResponse: Response for ``POST /console/session``.
  - `created` boolean, required: True when this sign-in wrote something: a new identity, a membership from an accepted invitation, or the default organization for an identity that belonged nowhere.
  - `user` ConsoleUserInfo, required: The signed-in OIDC identity. Carries no role: a role is held per organization, so it lives on :class:`~ndi_service.app.schemas.organization.OrganizationInfo`.
    - `id` string, uuid, required
    - `email` string, nullable
    - `created_at` string, date-time, required
  - `organizations` OrganizationInfo[], required: Every organization the user belongs to. Empty means they belong to none yet.
    - `organization_id` string, uuid, required
    - `name` string, required: Storage-safe slug, derived server-side. Stable; not shown to users.
    - `display_name` string, required: The name a human gave the organization.
    - `role` 'owner' | 'admin' | 'member', required: The signed-in user's role here. It may differ per organization.
    - `rate_limit_rpm` integer, required
    - `included_credits` integer, nullable: Lifetime credit allowance; null means unlimited.
    - `joined_at` string, date-time, required
    - `created_at` string, date-time, required
    - `default_workspace_id` string, uuid, nullable: The signed-in user's Perception Playground in this organization — where the console's perception tools upload by default. Null when it has not been provisioned yet, which the console handles by falling back to workspace-free uploads.
  - `can_create_organization` boolean, required: Whether this user may still create an organization themselves.
  - `can_run_evals` boolean: Whether this identity may use the eval console (a Nace staff email domain). The console hides the section when false; the routes enforce it regardless.

## Other responses

- `201`: First sign-in, an invitation was accepted into an organization, or the default organization was provisioned.
- `400`: Bad Request
- `401`: Unauthorized
- `402`: Payment Required
- `403`: Unverified email, identity not allowlisted, or account disabled.
- `404`: Not Found
- `409`: The identity is ambiguous, or an invitation was withdrawn while the join was in flight.
- `413`: Request Entity Too Large
- `422`: Unprocessable Entity
- `500`: Internal Server Error
- `503`: Service Unavailable

---

[API](https://skmtc.dev/nace/apis/ndi-service.md) - [All operations](https://skmtc.dev/nace/apis/ndi-service/llms.txt) - [OpenAPI document](https://skmtc.dev/nace/apis/ndi-service/revisions/d9d1f8ec2207?raw)