RUrunbear

Create a browser session

Mint a short-lived session pass plus a resume token for one browser visitor, and create the single thread that pass is bound to. Call this from YOUR server after authenticating the visitor — the org API key must never reach the browser. The returned pass is the only credential the browser holds; it can read and run exactly one thread of one agent and nothing else.

post/v1/sessions

Request

  • Base URL
    https://api.runbear.io
  • Auth
    HTTP bearer

Request body

assistant_idstring uuid required

Unique identifier of the agent this session may talk to. The pass carries it; a request naming any other agent is rejected.

thread_idstring uuid

Resume an existing thread instead of creating one. The thread must belong to your organization AND to assistant_id. Those are the ONLY two checks Runbear makes: it holds no visitor identity against a thread, so it cannot tell whether the visitor you are minting for is the one who owns this conversation. If this value came from the browser, verify against your own records that it belongs to the authenticated visitor before forwarding it — in a single-agent deployment both of Runbear's checks pass for every thread in your account. Omit to create a new thread — the usual case.

endUserstring

An opaque, stable identifier for the signed-in visitor (your user id — never an email). Runbear salts and hashes it server-side and binds the resume token to it; refresh must then present the same value. Omit only for genuinely anonymous widgets: without it the resume token is a pure bearer credential and is issued with a materially shorter lifetime (2 hours instead of 24).

Example request

{
  "assistant_id": "0fade940-133f-49e6-bf4b-8f662186479b",
  "endUser": "user_8fj2k"
}

Response

Default Response

Example response

{
  "pass": {
    "expiresInSeconds": 900
  },
  "resumeToken": {
    "expiresInSeconds": 900
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.