---
title: "Activate the control-plane browser cookie transport"
method: POST
path: "/agent/v1/control-plane/session/browser"
tags: ["ControlPlane"]
---

# Activate the control-plane browser cookie transport

`POST /agent/v1/control-plane/session/browser`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/agent/v1/control-plane/session/browser`
- Auth: HTTP bearer

Exchanges the current live control-plane bearer-backed session row for one opaque HttpOnly cookie handle. Requires the configured console Origin or Referer and rejects cross-site browser requests. The response contains metadata only and never echoes the bearer or cookie value.

## Response `200`

Browser cookie set; metadata returned

- ControlPlaneBrowserSession
  - `session_transport` 'cookie', required
  - `principal_id` string, uuid, required
  - `expires_at` string, date-time, required
  - `absolute_expires_at` string, date-time, required
  - `amr` string[], required

## Other responses

- `401`: No live bearer-backed session
- `403`: Browser origin does not match

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)