---
title: "Create a bridge session."
method: POST
path: "/v1/bridge/sessions"
tags: ["BridgeSessionsV1"]
---

# Create a bridge session.

`POST /v1/bridge/sessions`

## Request

- Base URL: `https://sandbox.straddle.com`
- URL: `https://sandbox.straddle.com/v1/bridge/sessions`
- Auth: HTTP bearer

Creates a short lived bridge session for a customer. The session carries the client secret the Bridge widget needs to start, and the redirect url the customer returns to once the widget is done. Send an Idempotency-Key header to make retries safe.

## Headers

- `Straddle-Account-Id` string, uuid
- `Request-Id` string
- `Correlation-Id` string
- `Idempotency-Key` string

## Request body

- CreateBridgeSessionV1Request
  - `customer_id` string, uuid, required: The unique identifier of the customer the session is created for.
  - `redirect_url` string, required: Absolute https url the customer is returned to when the bridge flow finishes. Carried through to the session as given.
  - `config` BridgeSessionConfigV1: Optional configuration for the session.
    - `sandbox_outcome` 'standard' | 'active' | 'rejected' | 'review': Sandbox outcome to simulate for the session. Only 'standard' is accepted in production.

## Response `201`

Created

- BridgeSessionV1ItemResponse
  - `meta` ResponseMetadata, required: Metadata about the API request, including an identifier and timestamp.
    - `api_request_id` string, uuid, required: Unique identifier for this API request, useful for troubleshooting.
    - `api_request_timestamp` string, date-time, required: Timestamp for this API request, useful for troubleshooting.
  - `response_type` 'object' | 'array' | 'error' | 'none', required: Indicates the structure of the returned content. - "object" means the `data` field contains a single JSON object. - "array" means the `data` field contains an array of objects. - "error" means the `data` field contains an error object with details of the issue. - "none" means no data is returned.
  - `data` BridgeSessionV1, required
    - `id` string, required: The unique identifier of the bridge session. An opaque Straddle identifier; treat it as a string and do not parse it.
    - `client_secret` string, required: The secret the Bridge widget authenticates with. It is opaque and must not be decoded, stored or logged.
    - `expires_at` string, date-time, required: When the session expires. This is the only lifetime signal for the session; no fixed time to live is promised and it may change without notice.

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `409`: Conflict
- `422`: Validation Failed
- `500`: Server Error

## Changes

- **2026-10-23** `7317fef4a9b0`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/straddleio/apis/straddle-api/changes/v1/bridge/sessions/post.md)

---

[API](https://skmtc.dev/straddleio/apis/straddle-api.md) - [All operations](https://skmtc.dev/straddleio/apis/straddle-api/llms.txt) - [OpenAPI document](https://skmtc.dev/straddleio/apis/straddle-api/revisions/7317fef4a9b0?raw)