---
title: "Mint Order Intake Session"
method: POST
path: "/v1/order-intake/public/{public_id}/sessions"
tags: ["Order Intake"]
---

# Mint Order Intake Session

`POST /v1/order-intake/public/{public_id}/sessions`

## Request

- Base URL: `https://api.sandbox.usenash.com`
- URL: `https://api.sandbox.usenash.com/v1/order-intake/public/{public_id}/sessions`
- Auth: none declared

Mint a short-lived session for a hosted Order Intake form from its public link. Anonymous and rate-limited. Returns the browser envelope: `client_secret`, `expires_at`, `session_id`, `api_region`. Send `secret` when the form has a PIN.

Denials are deliberately uniform: `FORBIDDEN` covers every refusal before the PIN step. `ORDER_INTAKE_PIN_REQUIRED` and `ORDER_INTAKE_PIN_INVALID` (401) appear only for a live link. `RATE_LIMITED` (429) and `ORDER_INTAKE_UNAVAILABLE` (503) carry `Retry-After`.

## Path parameters

- `public_id` string, required: The form's public link id (`oil_…`), the last segment of its URL.

## Request body

- OrderIntakeMintRequest: The mint body, `{"secret"?: "1234"}`: the form's PIN, when it has one. Deliberately loose: a malformed PIN is the same `ORDER_INTAKE_PIN_INVALID` as a wrong one, decided by the service after the link resolves as live, never a distinct validation error that could tell a caller about the form. Unknown keys are ignored. Named `secret` so the request logger redacts it.
  - `secret` string, nullable: The form's PIN, when it is PIN-protected.

## Response `201`

Created

- EmbedSessionEnvelope: The mint response, and the entire browser contract (PLAT-22260). The host backend forwards this verbatim to its page; it is not expected to add, rename, or reshape anything. Four fields, each earning its place: * `client_secret` — the only value that authenticates the browser. * `expires_at` — so the page can refresh *before* a request fails rather than discovering expiry as a broken widget. * `session_id` — non-secret. The browser's cache key and the id that shows up in logs and support tickets, which is exactly why it is separate from the secret rather than derived from it. * `api_region` — which Nash API the widget bundle should talk to, as one of the published wire tokens the widget loader accepts: `"us"` or `"au"`. Never a deployment region string like `us-west-1` — the browser resolves this against its own build-time endpoint table, not against server config (see `embed_session_service.resolve_api_region`).
  - `client_secret` string, required: Browser-held session secret (`wcs_…`). Shown once, never retrievable.
  - `expires_at` string, date-time, required
  - `session_id` string, required
  - `api_region` string, required

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `422`: Unprocessable Content
- `429`: Too Many Requests
- `503`: Service Unavailable

---

[API](https://skmtc.dev/nash/apis/nash-api.md) - [All operations](https://skmtc.dev/nash/apis/nash-api/llms.txt) - [OpenAPI document](https://skmtc.dev/nash/apis/nash-api/revisions/e3713837c5c9?raw)