> ## Documentation Index > Fetch the complete documentation index at: https://docs.vos.verolabs.co/llms.txt > Use this file to discover all available pages before exploring further. # Resume an account session > Request a JWT for an existing session and complete two-factor authentication if required Use this endpoint when you already hold an account `sessionToken`. Send it in `X-Auth-Session-Token`, without a request body. This value is the account session token, not the REST API JWT. ```bash theme={null} COOKIE_JAR="$(mktemp)" chmod 600 "$COOKIE_JAR" read -r -s -p "Session token: " SESSION_TOKEN printf '\n' AUTH_RESPONSE="$(curl --silent --show-error --fail-with-body \ --request POST 'https://platform.verolabs.co/api/auth/mfa/resume' \ --cookie-jar "$COOKIE_JAR" \ --header "X-Auth-Session-Token: $SESSION_TOKEN")" unset SESSION_TOKEN printf '%s\n' "$AUTH_RESPONSE" | jq '{status, methods, expiresAt}' ``` If `status` is `authenticated`, the response includes a JWT for protected REST API requests. If `status` is `mfa_required`, no JWT is returned. Preserve the cookie jar and complete [two-factor verification](/en/apis/rest/auth/post-api-auth-mfa-verify) with a method listed in `methods`. Use the same verification and JWT-extraction steps as [password login](/en/apis/rest/auth/post-api-auth-login), with `AUTH_BASE_URL="https://platform.verolabs.co"`. Remove the cookie jar when authentication is complete. A missing token returns HTTP `401` with `session_missing`. If the session is invalid, sign in again. Browser requests must originate from the authentication host. ## OpenAPI ````yaml openapi.oms.en.json POST /api/auth/mfa/resume openapi: 3.0.3 info: title: VOS OMS Public API version: 1.0.0 description: >- Public REST API surface for Vero OMS. Authentication requests use platform.verolabs.co. REST API requests use api-oms.verolabs.co. servers: - url: https://platform.verolabs.co description: Authentication host - url: https://api-oms.verolabs.co description: REST API host security: [] tags: - name: Authentication description: >- Password login, two-factor authentication, session resumption, and password recovery. - name: Trading description: Order entry, quote, IOI, and trading activity APIs. - name: Portfolio & Risk description: Accounts, holdings, mappings, and risk-rule read APIs. - name: Administration description: Permissions, groups, workflow, reference data, and audit APIs. - name: System & Diagnostics description: Health and latency endpoints. paths: /api/auth/mfa/resume: post: tags: - Authentication summary: Resume an account session description: >- Uses an existing sessionToken in X-Auth-Session-Token to request a JWT without resubmitting the password. Returns the same authenticated or mfa_required response as password login. If a second factor is required, preserve the response cookie and call POST /api/auth/mfa/verify. No request body is required. Browser requests must use the authentication host origin. operationId: post_api_auth_mfa_resume responses: '200': description: >- Authenticated session and JWT, or a pending second-factor challenge. Inspect status. content: application/json: schema: $ref: '#/components/schemas/AuthLoginResponse' examples: authenticated: summary: Authentication complete value: status: authenticated sessionToken: jwt: session: active: true authenticator_assurance_level: aal1 tokenized: identity: null tokenizedSession: active: true authenticator_assurance_level: aal1 tokenized: mfa_required: summary: Second factor required; preserve Set-Cookie value: status: mfa_required methods: - totp - lookup_secret expiresAt: '2026-10-20T12:00:00Z' headers: Set-Cookie: description: >- For mfa_required, sets the HttpOnly vos_mfa_challenge cookie, scoped to /api/auth with SameSite=Strict and Secure over HTTPS. Preserve this cookie for POST /api/auth/mfa/verify. It expires at expiresAt. For authenticated, clears any pending challenge cookie. schema: type: string '400': description: Session authentication request rejected (invalid_mfa_request). content: application/json: schema: $ref: '#/components/schemas/AuthError' '401': description: >- Missing session token (session_missing), or invalid session (session_invalid). Sign in again. content: application/json: schema: $ref: '#/components/schemas/AuthError' '403': description: >- Request origin or session authentication requirements rejected (origin_not_allowed, session_invalid, session_refresh_required, session_aal2_required). content: application/json: schema: $ref: '#/components/schemas/AuthError' '409': description: No supported enrolled second factor is available (mfa_unavailable). content: application/json: schema: $ref: '#/components/schemas/AuthError' '410': description: >- Challenge cookie missing/expired (challenge_expired), or challenge no longer valid (flow_expired). Restart login or session resumption. content: application/json: schema: $ref: '#/components/schemas/AuthError' '429': description: Too many authentication requests (rate_limited). content: application/json: schema: $ref: '#/components/schemas/AuthError' '502': description: >- Authentication unavailable or JWT not returned (mfa_service_unavailable, missing_jwt). content: application/json: schema: $ref: '#/components/schemas/AuthError' security: - authSessionToken: [] servers: - url: https://platform.verolabs.co components: schemas: AuthLoginResponse: description: >- Check status on every successful HTTP response. authenticated includes the JWT; mfa_required requires POST /api/auth/mfa/verify with the response cookie. oneOf: - $ref: '#/components/schemas/AuthAuthenticatedResponse' - $ref: '#/components/schemas/AuthMfaChallenge' discriminator: propertyName: status mapping: authenticated: '#/components/schemas/AuthAuthenticatedResponse' mfa_required: '#/components/schemas/AuthMfaChallenge' AuthError: type: object properties: error: type: string description: Machine-readable error code or error category. message: type: string description: Human-readable error message. status: type: integer format: int32 description: HTTP status code of this error response. required: - error - message - status description: >- Authentication error envelope. Use the HTTP status and error code to select the next action. AuthAuthenticatedResponse: type: object description: >- Completed authentication. The JWT is issued only after all required authentication factors pass. properties: status: type: string enum: - authenticated description: Indicates that authentication is complete and the JWT can be used. sessionToken: type: string description: >- Account session token. Keep it confidential. Use it for session resumption; use jwt for REST API authorization. jwt: type: string description: >- Bearer JWT for protected REST API requests. Send it as Authorization: Bearer . session: description: Active authenticated session. allOf: - $ref: '#/components/schemas/AuthSession' identity: description: Account identity, or null if absent. allOf: - $ref: '#/components/schemas/AuthIdentity' tokenizedSession: description: Authenticated session containing the JWT in tokenized. allOf: - $ref: '#/components/schemas/AuthSession' required: - status - sessionToken - jwt - session - identity - tokenizedSession additionalProperties: false AuthMfaChallenge: type: object description: >- Password or existing session accepted, but a second factor is required. This response does not contain jwt or sessionToken. properties: status: type: string enum: - mfa_required description: Requires a second factor before issuing a JWT. methods: type: array minItems: 1 uniqueItems: true description: >- Available enrolled methods. totp uses the six-digit authenticator code; lookup_secret uses an unused backup code. Submit a method from this list. items: type: string enum: - totp - lookup_secret description: Supported second-factor method. expiresAt: type: string format: date-time description: >- Challenge expiration time in UTC. Restart login or session resumption after it expires. required: - status - methods - expiresAt additionalProperties: false AuthSession: type: object properties: id: type: string description: Unique identifier for the record. active: type: boolean description: Indicates whether the session is active. authenticated_at: type: string format: date-time description: Timestamp when the session was authenticated. expires_at: type: string format: date-time description: Timestamp when the session expires. devices: type: array items: $ref: '#/components/schemas/AuthSessionDevice' description: Devices associated with the authenticated session. identity: $ref: '#/components/schemas/AuthIdentity' tokenized: type: string description: Bearer JWT issued for REST API calls. authenticator_assurance_level: type: string enum: - aal1 - aal2 description: >- Authentication assurance level: aal1 after first-factor authentication; aal2 after successful two-factor authentication. description: >- Authenticated session details. tokenized contains the Bearer JWT when present. additionalProperties: true AuthIdentity: type: object properties: id: type: string description: Unique identifier for the record. traits: type: object additionalProperties: true description: Account attributes returned with the authenticated session. description: >- Account identity returned with the authenticated session, or null if no identity is returned. additionalProperties: true nullable: true AuthSessionDevice: type: object properties: ip_address: type: string description: IP address reported for the session device. location: type: string description: Location metadata reported for the session device. user_agent: type: string description: User agent reported for the session device. description: AuthSessionDevice schema. securitySchemes: authSessionToken: type: apiKey in: header name: X-Auth-Session-Token description: >- Existing account session token returned as sessionToken after authentication. This is not the Bearer JWT. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.