---
title: "Start diagnostic sessions"
method: POST
path: "/api/v1/experience/diagnostic-sessions/start"
tags: ["experience"]
---

# Start diagnostic sessions

`POST /api/v1/experience/diagnostic-sessions/start`

## Request

- Base URL: `https://point11.ai`
- URL: `https://point11.ai/api/v1/experience/diagnostic-sessions/start`
- Auth: OAuth 2 (authorization code, authorization URL `https://auth.point11.ai/oauth2/authorize`, token URL `https://auth.point11.ai/oauth2/token`)

Alpha's site test tool, for an Alpha turn only: any other caller (an API key, a dashboard session, an OAuth client, another agent) is refused 403 AUTH_FORBIDDEN. Point11's shopper opens url (a page on one of the organization's own websites, on desktop or a phone) in a real browser, tries task, and the scorer judges it against criteria. It binds no customer or campaign, enters no Experience figure, only looks (never signs in, buys or submits a form), and draws no credits. Returns testId at once, or a refusal (outside_site, unsafe, unavailable); the test takes minutes: read it with experience_diagnostic_sessions_get. The same Idempotency-Key answers the same testId.

## Headers

- `Point11-Organization` string, uuid
- `Idempotency-Key` string, uuid, required

## Request body

- ExperienceDiagnosticSessionsStartRequest
  - `url` string, uri, required: Where the test starts: an absolute http(s) URL on one of the organization's websites.
  - `task` string, required: What a shopper tries to do, in plain words, as one task (for example: search for odor from the header and open the first result).
  - `criteria` string[], required: What must be true for the task to count as working (for example: a detergent is among the first three results).
  - `device` 'desktop' | 'mobile', required

## Response `200`

Success.

- ExperienceDiagnosticSessionsStartResponse
  - `testId` string, uuid, nullable, required: The started test; null when it was refused.
  - `refusal` object, nullable, required: Why the test did not start; null when it did.
    - `state` 'refused', required
    - `reason` 'outside_site' | 'unsafe' | 'unavailable', required
    - `detail` string, required

## Other responses

- `400`: The input, query, or Idempotency-Key is invalid.
- `401`: The bearer is missing, expired, or not accepted.
- `402`: Billing refused the write: the code names the reason and `details.reason` carries it.
- `403`: The credential lacks the operation's scope or role, or the operation needs a different door.
- `404`: The resource or organization does not exist for this caller.
- `405`: This path takes another HTTP method, named in `Allow`.
- `409`: The request conflicts with current state or with prior use of its Idempotency-Key.
- `413`: The request, or the answer it asks for, is too large; narrow it.
- `429`: The credential's rate budget is spent; retry after `Retry-After` seconds.
- `500`: An unexpected server failure; retry later. Only `request_id` identifies it.
- `503`: A dependency is temporarily unavailable; retry after `Retry-After` seconds.
- `default`: Another status a product answers for its own refusal (for example `415` for an unsupported attachment); branch on `code`.

---

[API](https://skmtc.dev/point11/apis/point11-api.md) · [All operations](https://skmtc.dev/point11/apis/point11-api/llms.txt) · [OpenAPI document](https://skmtc.dev/point11/apis/point11-api/revisions/36a84c7aca11?raw)