---
title: "Create REST API session"
method: POST
path: "/sessions"
tags: ["Authentication"]
---

# Create REST API session

`POST /sessions`

Creates a new session and returns session credentials.
On success, the server sets a `session_handle` cookie and returns a JSON object with session GUID and server information.

For subsequent requests, provide the session GUID either:
- In the `Session-Id` request header
- Via the `session_handle` cookie

Authentication can also be provided via HTTP Basic Authentication header instead of JSON body.

## Request body

- object
  - `login` string — Username
  - `password` string — Password
  - `attachNotificationHandler` boolean — If true, attaches notification handler to receive alarm notifications

## Response `200`

Session created successfully

- SessionToken
  - `sessionHandle` string, uuid — Session GUID for use in Session-Id header
  - `session` NXCSession
    - `server` object
      - `address` string
      - `serverName` string
      - `version` string
      - `color` string
      - `id` integer
      - `timeZone` string
    - `user` object
      - `name` string
      - `id` integer
      - `globalAccessRights` integer
    - `encrypted` boolean
    - `objectsSynchronized` boolean
    - `passwordExpired` boolean
    - `zoningEnabled` boolean

## Other responses

- `400` — Invalid request
- `401` — Access denied

## Changes

- **2026-01-30** `32f48ec94aec` — 7 info
  - added the new optional request property `attachNotificationHandler`
  - request body became optional
  - added the non-success response with the status `400`
  - added the optional property `description` to the response with the `401` status
  - …3 more
- **2023-02-28** `910d3ad08e09` — 2 info
  - api operation id `createSession` was added
  - added the non-success response with the status `401`
- **2023-02-23** `9c09a2aad349` — 1 breaking, 4 warning, 3 info
  - request body became required
  - the optional response header `Session-Id` removed for the status `200`
  - removed the request property `attachNotificationHandler`
  - removed the optional property `session` from the response with the `200` status
  - …4 more

[Change history](https://skmtc.dev/netxms/apis/netxms-rest-api/changes/sessions/post.md)

---

[API](https://skmtc.dev/netxms/apis/netxms-rest-api.md) · [All operations](https://skmtc.dev/netxms/apis/netxms-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/netxms/netxms-rest-api/revisions/04789afedcb3/schema)