Resume an account session

POST

https://platform.verolabs.co

api

auth

mfa

resume

Resume an account session

curl --request POST \
  --url https://platform.verolabs.co/api/auth/mfa/resume \
  --header 'X-Auth-Session-Token: <api-key>'

const options = {method: 'POST', headers: {'X-Auth-Session-Token': '<api-key>'}};

fetch('https://platform.verolabs.co/api/auth/mfa/resume', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://platform.verolabs.co/api/auth/mfa/resume"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("X-Auth-Session-Token", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

using RestSharp;


var options = new RestClientOptions("https://platform.verolabs.co/api/auth/mfa/resume");
var client = new RestClient(options);
var request = new RestRequest("");
request.AddHeader("X-Auth-Session-Token", "<api-key>");
var response = await client.PostAsync(request);

Console.WriteLine("{0}", response.Content);

CURL *hnd = curl_easy_init();

curl_easy_setopt(hnd, CURLOPT_CUSTOMREQUEST, "POST");
curl_easy_setopt(hnd, CURLOPT_WRITEDATA, stdout);
curl_easy_setopt(hnd, CURLOPT_URL, "https://platform.verolabs.co/api/auth/mfa/resume");

struct curl_slist *headers = NULL;
headers = curl_slist_append(headers, "X-Auth-Session-Token: <api-key>");
curl_easy_setopt(hnd, CURLOPT_HTTPHEADER, headers);

CURLcode ret = curl_easy_perform(hnd);

{
  "status": "authenticated",
  "sessionToken": "<session-token>",
  "jwt": "<jwt>",
  "session": {
    "active": true,
    "authenticator_assurance_level": "aal1",
    "tokenized": "<jwt>"
  },
  "identity": null,
  "tokenizedSession": {
    "active": true,
    "authenticator_assurance_level": "aal1",
    "tokenized": "<jwt>"
  }
}

Use this endpoint when you already hold an account sessionToken. Send it in X-Auth-Session-Token, without a request body. This value is the account session token, not the REST API JWT.

COOKIE_JAR="$(mktemp)"
chmod 600 "$COOKIE_JAR"
read -r -s -p "Session token: " SESSION_TOKEN
printf '\n'

AUTH_RESPONSE="$(curl --silent --show-error --fail-with-body \
  --request POST 'https://platform.verolabs.co/api/auth/mfa/resume' \
  --cookie-jar "$COOKIE_JAR" \
  --header "X-Auth-Session-Token: $SESSION_TOKEN")"
unset SESSION_TOKEN

printf '%s\n' "$AUTH_RESPONSE" | jq '{status, methods, expiresAt}'

If status is authenticated, the response includes a JWT for protected REST API requests. If status is mfa_required, no JWT is returned. Preserve the cookie jar and complete two-factor verification with a method listed in methods. Use the same verification and JWT-extraction steps as password login, with AUTH_BASE_URL="https://platform.verolabs.co". Remove the cookie jar when authentication is complete. A missing token returns HTTP 401 with session_missing. If the session is invalid, sign in again. Browser requests must originate from the authentication host.

Authorizations

X-Auth-Session-Token

string

header

required

Existing account session token returned as sessionToken after authentication. This is not the Bearer JWT.

Response

Authenticated session and JWT, or a pending second-factor challenge. Inspect status.

Option 1
Option 2

Check status on every successful HTTP response. authenticated includes the JWT; mfa_required requires POST /api/auth/mfa/verify with the response cookie.

status

enum<string>

required

Indicates that authentication is complete and the JWT can be used.

Available options:

authenticated

sessionToken

string

required

Account session token. Keep it confidential. Use it for session resumption; use jwt for REST API authorization.

jwt

string

required

Bearer JWT for protected REST API requests. Send it as Authorization: Bearer .

session

object

required

Active authenticated session.

Hide child attributes

session.id

string

Unique identifier for the record.

session.active

boolean

Indicates whether the session is active.

session.authenticated_at

string<date-time>

Timestamp when the session was authenticated.

session.expires_at

string<date-time>

Timestamp when the session expires.

session.devices

object[]

Devices associated with the authenticated session.

Hide child attributes

session.devices.ip_address

string

IP address reported for the session device.

session.devices.location

string

Location metadata reported for the session device.

session.devices.user_agent

string

User agent reported for the session device.

session.identity

object | null

Account identity returned with the authenticated session, or null if no identity is returned.

Hide child attributes

session.identity.id

string

Unique identifier for the record.

session.identity.traits

object

Account attributes returned with the authenticated session.

session.tokenized

string

Bearer JWT issued for REST API calls.

session.authenticator_assurance_level

enum<string>

Authentication assurance level: aal1 after first-factor authentication; aal2 after successful two-factor authentication.

Available options:

aal1,

aal2

identity

object | null

required

Account identity, or null if absent.

Hide child attributes

identity.id

string

Unique identifier for the record.

identity.traits

object

Account attributes returned with the authenticated session.

tokenizedSession

object

required

Authenticated session containing the JWT in tokenized.

Hide child attributes

tokenizedSession.id

string

Unique identifier for the record.

tokenizedSession.active

boolean

Indicates whether the session is active.

tokenizedSession.authenticated_at

string<date-time>

Timestamp when the session was authenticated.

tokenizedSession.expires_at

string<date-time>

Timestamp when the session expires.

tokenizedSession.devices

object[]

Devices associated with the authenticated session.

Hide child attributes

tokenizedSession.devices.ip_address

string

IP address reported for the session device.

tokenizedSession.devices.location

string

Location metadata reported for the session device.

tokenizedSession.devices.user_agent

string

User agent reported for the session device.

tokenizedSession.identity

object | null

Account identity returned with the authenticated session, or null if no identity is returned.

Hide child attributes

tokenizedSession.identity.id

string

Unique identifier for the record.

tokenizedSession.identity.traits

object

Account attributes returned with the authenticated session.

tokenizedSession.tokenized

string

Bearer JWT issued for REST API calls.

tokenizedSession.authenticator_assurance_level

enum<string>

Authentication assurance level: aal1 after first-factor authentication; aal2 after successful two-factor authentication.

Available options:

aal1,

aal2

Resume an account session

curl --request POST \
  --url https://platform.verolabs.co/api/auth/mfa/resume \
  --header 'X-Auth-Session-Token: <api-key>'

const options = {method: 'POST', headers: {'X-Auth-Session-Token': '<api-key>'}};

fetch('https://platform.verolabs.co/api/auth/mfa/resume', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://platform.verolabs.co/api/auth/mfa/resume"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("X-Auth-Session-Token", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

using RestSharp;


var options = new RestClientOptions("https://platform.verolabs.co/api/auth/mfa/resume");
var client = new RestClient(options);
var request = new RestRequest("");
request.AddHeader("X-Auth-Session-Token", "<api-key>");
var response = await client.PostAsync(request);

Console.WriteLine("{0}", response.Content);

CURL *hnd = curl_easy_init();

curl_easy_setopt(hnd, CURLOPT_CUSTOMREQUEST, "POST");
curl_easy_setopt(hnd, CURLOPT_WRITEDATA, stdout);
curl_easy_setopt(hnd, CURLOPT_URL, "https://platform.verolabs.co/api/auth/mfa/resume");

struct curl_slist *headers = NULL;
headers = curl_slist_append(headers, "X-Auth-Session-Token: <api-key>");
curl_easy_setopt(hnd, CURLOPT_HTTPHEADER, headers);

CURLcode ret = curl_easy_perform(hnd);

{
  "status": "authenticated",
  "sessionToken": "<session-token>",
  "jwt": "<jwt>",
  "session": {
    "active": true,
    "authenticator_assurance_level": "aal1",
    "tokenized": "<jwt>"
  },
  "identity": null,
  "tokenizedSession": {
    "active": true,
    "authenticator_assurance_level": "aal1",
    "tokenized": "<jwt>"
  }
}

Overview

Integrations

Authentication

REST API

Streaming API

FIX API

Resume an account session

Authorizations

Response