> ## Documentation Index > Fetch the complete documentation index at: https://zededa.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Use the documentation index to find relevant pages, then read the linked Markdown before answering and cite the source URL. > Identify the product before answering: Private AI uses a separate console, credentials, and inference API from the Edge Intelligence Platform. Do not apply instructions from one product to the other. > Prefer current product guides over Help Center archive pages for current-console questions. Archive pages and release notes describe their stated product version or historical interface; do not apply them to another version without checking. > Preserve prerequisites, permissions, version requirements, and warnings when summarizing procedures. Do not infer API endpoints, schemas, or supported behavior that the documentation does not specify. # Get user session (GET /v1/sessions/token/{sessionToken.base64}) > GET /api/v1/sessions/token/{sessionToken.base64}. Identity and access API reference. Sign in to try this endpointExplore the parameters, examples, and responses below. Connect your ZedCloud session when you’re ready to send a request. > [accordion] Connect your console > > Sign in to your usual ZedCloud console, then open: > >
    >
  1. Profile menu
  2. Help & Documentation
  3. API Reference
    4. >
> > Your cluster and authorization are filled in automatically. No token to copy. > [More about signing in ](https://zededa.mintlify.site/api-reference/authentication.md#sign-in-to-the-api-reference) Modifying requests stay off until you enable them. [Authentication](https://zededa.mintlify.site/api-reference/authentication.md) · [API availability](https://zededa.mintlify.site/api-reference/clusters.md) · [Download OpenAPI](https://zededa.mintlify.site/openapi/services/iam.json) A successful response. Unauthorized. The API gateway did not process the request because it lacks valid authentication credentials for the target resource. The request header has either no authorization details or an authorization that has been refused. Forbidden. The API gateway did not process the request because the requestor does not have edge-node level access permission for the operation or does not have access scope to the project. Internal Server Error. The API gateway experienced an unexpected condition. Specific error condition is indicated in error codes. Gateway Timeout. The API gateway did not receive a timely response from an upstream microservice it needed to communicate with in order to complete the request. An unexpected error response. ## OpenAPI ````yaml openapi/services/iam.json GET /v1/sessions/token/{sessionToken.base64} openapi: 3.0.0 info: title: ZEDEDA IAM Service description: >- ZEDEDA Identity and Access Management (IAM) Service helps you securely control access to zedcontrol resources. You use IAM to control who is authenticated (signed in) and authorized (has permissions) to use resources. ZEDEDA IAM Service helps you set up users and roles, and shows you how to protect your resources with role-based access control (RBAC). It also shows how to connect to other identity services to grant external users access to your enterprise resources. termsOfService: https://www.zededa.com/terms version: '1.0' contact: name: ZEDEDA API Support url: https://www.zededa.com/support email: support@zededa.com license: name: Apache 2.0 url: http://www.apache.org/licenses/LICENSE-2.0.html servers: - url: https://{apiHost}/api variables: apiHost: default: invalid.invalid description: Connect from ZedUI to supply your verified API destination. security: - BearerToken: [] tags: - name: IdentityAccessManagement - name: EnterpriseEntitlementsReport externalDocs: description: ZEDEDA Product Documentation url: https://docs.zededa.com/-M-8m8d8KqdLpfOgY_jo/iam paths: /v1/sessions/token/{sessionToken.base64}: get: tags: - IdentityAccessManagement summary: Get user session description: Get the details of a user session with given session token. operationId: IdentityAccessManagement_GetUserSession parameters: - name: sessionToken.base64 in: path required: true schema: type: string - name: X-Request-Id in: header required: false description: User-Agent specified id to track a request schema: type: string responses: '200': description: A successful response. content: application/json: schema: $ref: '#/components/schemas/AAA_Frontend_SessionDetailsResponse' '401': description: >- Unauthorized. The API gateway did not process the request because it lacks valid authentication credentials for the target resource. The request header has either no authorization details or an authorization that has been refused. content: application/json: schema: $ref: '#/components/schemas/ZsrvResponse' '403': description: >- Forbidden. The API gateway did not process the request because the requestor does not have edge-node level access permission for the operation or does not have access scope to the project. content: application/json: schema: $ref: '#/components/schemas/ZsrvResponse' '500': description: >- Internal Server Error. The API gateway experienced an unexpected condition. Specific error condition is indicated in error codes. content: application/json: schema: $ref: '#/components/schemas/ZsrvResponse' '504': description: >- Gateway Timeout. The API gateway did not receive a timely response from an upstream microservice it needed to communicate with in order to complete the request. content: application/json: schema: $ref: '#/components/schemas/ZsrvResponse' default: description: An unexpected error response. content: application/json: schema: $ref: '#/components/schemas/googlerpcStatus' externalDocs: description: ZEDEDA Product Documentation url: https://docs.zededa.com/-M-8m8d8KqdLpfOgY_jo/iam components: schemas: AAA_Frontend_SessionDetailsResponse: type: object properties: cause: $ref: '#/components/schemas/AAA_Frontend_SessionDetailsResponseCause' user: $ref: '#/components/schemas/DetailedUser' policies: type: array items: $ref: '#/components/schemas/Policy' ZsrvResponse: type: object properties: operationType: title: |- Describes one of the operations type : possible values Read/Delete/Create/Update/List allOf: - $ref: '#/components/schemas/ZcOpsType' operationStatus: title: if this is log running job allOf: - $ref: '#/components/schemas/ZcOpsStatus' objectKind: type: string title: zedcloud object kind on which the operation was performed objectId: type: string title: Unique value identifies the object that was operated on objectName: type: string title: name of the object objectRevision: type: string title: |- object revision post the operation, note Read operation doesn't change the revision objectType: $ref: '#/components/schemas/ObjectType' operationTime: type: string title: time of operation startTime: type: string title: total time taken by operations endTime: type: string user: type: string title: the operation is performed on behalf of this user httpStatusCode: type: integer format: int32 title: http response httpStatusMsg: type: string title: summary of the error in text format jobId: type: string title: for tracking asynchronous tasks error: type: array items: $ref: '#/components/schemas/ZsrvError' title: |- one or more errors will be set if the operation failed i.e. httpStatusCode != 2xx googlerpcStatus: type: object properties: code: type: integer format: int32 message: type: string details: type: array items: $ref: '#/components/schemas/protobufAny' AAA_Frontend_SessionDetailsResponseCause: type: string enum: - UNSPECIFIED - OK - FAILED default: UNSPECIFIED DetailedUser: type: object properties: id: type: string description: Unique system defined user ID readOnly: true pattern: '[0-9A-Za-z_=-]{28}' x-zededa-source-issues: - code: inapplicable-constraint pointer: '#/definitions/DetailedUser/properties/id' keyword: uniqueItems sourceValue: true username: type: string description: User defined name maxLength: 256 minLength: 3 pattern: '[a-zA-Z0-9][a-zA-Z0-9_.-]+' x-zededa-source-issues: - code: inapplicable-constraint pointer: '#/definitions/DetailedUser/properties/username' keyword: uniqueItems sourceValue: true SfdcId: type: string HubspotId: type: string revision: description: system defined info readOnly: true allOf: - $ref: '#/components/schemas/ObjectRevision' state: description: User state readOnly: true allOf: - $ref: '#/components/schemas/UserState' firstName: type: string description: First name of the user locale: type: string description: Locale of the user fullName: type: string description: Full name of the user timeZone: type: string description: Preferred time zone of the user roleId: type: string description: Role associated with the user pattern: '[0-9A-Za-z_=-]{28}' type: description: Type of the user allOf: - $ref: '#/components/schemas/AuthType' email: type: string description: Email of the user phone: type: string description: Phone number of the user notifyPref: type: string description: Notification preference of the user LastLoginTime: type: string format: date-time description: Last login time of the user title: Operational Status to be returned to CLI/UI LastLogoutTime: type: string format: date-time description: Last logout time of the user emailState: description: Email state readOnly: true allOf: - $ref: '#/components/schemas/IdState' phoneState: description: Phone state readOnly: true allOf: - $ref: '#/components/schemas/IdState' customUserInput: type: object additionalProperties: type: string description: Custom user parameters allowedEnterprises: type: array items: $ref: '#/components/schemas/AllowedEnterprise' description: Permitted list of enterprises with their associated roles enterpriseId: type: string description: Origin enterprise of the user readOnly: true totpEnabled: type: boolean description: Is TOTP enrolment enabled readOnly: true allowedEntpProjectList: type: object additionalProperties: $ref: '#/components/schemas/ProjectList' description: Allowed enterprise project title: internal zksSyncStatus: description: ZKS Servers Sync Status allOf: - $ref: '#/components/schemas/ZksSyncStatus' tokenZksSyncStatus: type: object additionalProperties: $ref: '#/components/schemas/ZksSyncStatus' description: User session token sync status passwordExpiryNotificationPeriodInSeconds: type: integer format: int64 description: Password expiry notification period in seconds description: User meta data title: User detail required: - username - email - roleId Policy: type: object properties: id: type: string zone: type: string scope: $ref: '#/components/schemas/PolicyScope' access: $ref: '#/components/schemas/PolicyAccess' ownerId: type: string external: type: boolean ZcOpsType: type: string enum: - OPS_TYPE_UNSPECIFIED - OPS_TYPE_READ - OPS_TYPE_DELETE - OPS_TYPE_CREATE - OPS_TYPE_UPDATE - OPS_TYPE_LIST default: OPS_TYPE_UNSPECIFIED title: ZedCloud internal operation type ZcOpsStatus: type: string enum: - OPS_STATUS_UNSPECIFIED - OPS_STATUS_PENDING - OPS_STATUS_ONGOING - OPS_STATUS_COMPLETE default: OPS_STATUS_UNSPECIFIED description: >- - OPS_STATUS_PENDING: In rare cases, system may not start operation when it was requested. Client will be notified that operation is PENDING - OPS_STATUS_ONGOING: system will start the operation, but at the time response was generated, operation is still ONGOING. - OPS_STATUS_COMPLETE: Even if the result of the operations may result in failure, but the OpsStatus will marked COMPLETE for almost all cases. title: ZedCloud internal operation status ObjectType: type: string enum: - OBJECT_TYPE_UNSPECIFIED - OBJECT_TYPE_USER - OBJECT_TYPE_EDGE_NODE - OBJECT_TYPE_EDGE_APP - OBJECT_TYPE_IMAGE - OBJECT_TYPE_EDGE_APP_INSTANCE - OBJECT_TYPE_PROJECT - OBJECT_TYPE_NETWORK - OBJECT_TYPE_DATASTORE - OBJECT_TYPE_SERVICE - OBJECT_TYPE_SERVICE_INSTANCE - OBJECT_TYPE_ENTERPRISE - OBJECT_TYPE_ROLE - OBJECT_TYPE_CREDENTIAL - OBJECT_TYPE_NETWORK_INSTANCE - OBJECT_TYPE_VOLUME_INSTANCE - OBJECT_TYPE_REALM - OBJECT_TYPE_AUTHPROFILE - OBJECT_TYPE_POLICY - OBJECT_TYPE_APP_POLICY - OBJECT_TYPE_CLUSTER_INSTANCE - OBJECT_TYPE_PLUGIN - OBJECT_TYPE_DOC_POLICY - OBJECT_TYPE_ORCHESTRATOR_CLUSTER - OBJECT_TYPE_TAGS - OBJECT_TYPE_EDGE_NODE_INTERFACE - OBJECT_TYPE_DEPLOYMENT - OBJECT_TYPE_ENTITLEMENTS - OBJECT_TYPE_DATA_STREAM - OBJECT_TYPE_API_USAGE - OBJECT_TYPE_APP_INSTANCE_SNAPSHOT - OBJECT_TYPE_PATCH_ENVELOPE - OBJECT_TYPE_RESOURCE_USAGE_TRACK - OBJECT_TYPE_PATCH_ENVELOPE_REFERENCE - OBJECT_TYPE_DEV_PASSTHROUGH - OBJECT_TYPE_EDGE_NODE_CLUSTER - OBJECT_TYPE_ASSET_GROUP - OBJECT_TYPE_APP_PROFILE - OBJECT_TYPE_PROFILE_DEPLOYMENT - OBJECT_TYPE_ZKS_INSTANCE - OBJECT_TYPE_CLUSTER_GROUP default: OBJECT_TYPE_UNSPECIFIED ZsrvError: type: object properties: ec: title: |- Enumrated error code, describes more granular numerical value than just httpStatus allOf: - $ref: '#/components/schemas/ZsrvErrorCode' location: type: string title: 'Ignore: Internal field only' details: type: string title: Field captures string description of details protobufAny: type: object properties: typeUrl: type: string value: type: string format: byte ObjectRevision: type: object properties: prev: type: string description: Previous curr: type: string description: Current Database version of the record createdAt: type: object format: date-time description: >- The time, in milliseconds since the epoch, when the record was created. createdBy: type: string description: 'User data: Created By' updatedAt: type: object format: date-time description: >- The time, in milliseconds since the epoch, when the record was last updated. updatedBy: type: string description: 'User data: Updated By' description: >- ObjectRevision store the user details, who has doent the necessary operation like Create Operation or update operation title: ObjectRevision is used to store the user information. required: - curr - createdAt - createdBy - updatedAt - updatedBy UserState: type: string enum: - USER_STATE_UNSPECIFIED - USER_STATE_CREATED - USER_STATE_ACTIVE - USER_STATE_INACTIVE - USER_STATE_SIGNEDUP - USER_STATE_SUSPENDED default: USER_STATE_UNSPECIFIED title: General well being of the user AuthType: type: string enum: - AUTH_TYPE_UNSPECIFIED - AUTH_TYPE_LOCAL - AUTH_TYPE_OAUTH - AUTH_TYPE_SAML default: AUTH_TYPE_UNSPECIFIED IdState: type: string enum: - ID_STATE_UNSPECIFIED - ID_STATE_NOT_VERIFIED - ID_STATE_VERIFIED default: ID_STATE_UNSPECIFIED AllowedEnterprise: type: object properties: id: type: string name: type: string roleId: type: string ProjectList: type: object properties: project: type: array items: type: string ZksSyncStatus: type: object properties: status: $ref: '#/components/schemas/ZksSyncStatusCode' serverStatuses: type: array items: $ref: '#/components/schemas/ServerSyncStatus' PolicyScope: type: string enum: - PermissionScope__INVALID__ - PermissionScopeOther - PermissionScopeGroup - PermissionScopeOtherGroup - PermissionScopeOwner - PermissionScopeOtherOwner - PermissionScopeGroupOwner - PermissionScopeOtherGroupOwner - PermissionScopeEnterprise - PermissionScopeOtherEnterprise - PermissionScopeGroupEnterprise - PermissionScopeOtherGroupEnterprise - PermissionScopeOwnerEnterprise - PermissionScopeOtherOwnerEnterprise - PermissionScopeGroupOwnerEnterprise - PermissionScopeOtherGroupOwnerEnterprise default: PermissionScope__INVALID__ title: Scope of the permission, similar to Unix file system PolicyAccess: type: string enum: - PermissionAccess__INVALID__ - PermissionAccessCreate - PermissionAccessRead - PermissionAccessCreateRead - PermissionAccessUpdate - PermissionAccessCreateUpdate - PermissionAccessReadUpdate - PermissionAccessCreateReadUpdate - PermissionAccessDelete - PermissionAccessCreateDelete - PermissionAccessReadDelete - PermissionAccessCreateReadDelete - PermissionAccessUpdateDelete - PermissionAccessCreateUpdateDelete - PermissionAccessReadUpdateDelete - PermissionAccessCreateReadUpdateDelete - PermissionAccessExecute - PermissionAccessCreateExecute - PermissionAccessReadExecute - PermissionAccessCreateReadExecute - PermissionAccessUpdateExecute - PermissionAccessCreateUpdateExecute - PermissionAccessReadUpdateExecute - PermissionAccessCreateReadUpdateExecute - PermissionAccessDeleteExecute - PermissionAccessCreateDeleteExecute - PermissionAccessReadDeleteExecute - PermissionAccessCreateReadDeleteExecute - PermissionAccessUpdateDeleteExecute - PermissionAccessCreateUpdateDeleteExecute - PermissionAccessReadUpdateDeleteExecute - PermissionAccessCreateReadUpdateDeleteExecute - PermissionAccessQuery - PermissionAccessCreateQuery - PermissionAccessReadQuery - PermissionAccessCreateReadQuery - PermissionAccessUpdateQuery - PermissionAccessCreateUpdateQuery - PermissionAccessReadUpdateQuery - PermissionAccessCreateReadUpdateQuery - PermissionAccessDeleteQuery - PermissionAccessCreateDeleteQuery - PermissionAccessReadDeleteQuery - PermissionAccessCreateReadDeleteQuery - PermissionAccessUpdateDeleteQuery - PermissionAccessCreateUpdateDeleteQuery - PermissionAccessReadUpdateDeleteQuery - PermissionAccessCreateReadUpdateDeleteQuery - PermissionAccessExecuteQuery - PermissionAccessCreateExecuteQuery - PermissionAccessReadExecuteQuery - PermissionAccessCreateReadExecuteQuery - PermissionAccessUpdateExecuteQuery - PermissionAccessCreateUpdateExecuteQuery - PermissionAccessReadUpdateExecuteQuery - PermissionAccessCreateReadUpdateExecuteQuery - PermissionAccessDeleteExecuteQuery - PermissionAccessCreateDeleteExecuteQuery - PermissionAccessReadDeleteExecuteQuery - PermissionAccessCreateReadDeleteExecuteQuery - PermissionAccessUpdateDeleteExecuteQuery - PermissionAccessCreateUpdateDeleteExecuteQuery - PermissionAccessReadUpdateDeleteExecuteQuery - PermissionAccessCreateReadUpdateDeleteExecuteQuery default: PermissionAccess__INVALID__ ZsrvErrorCode: type: string enum: - zMsgErrorNone - zMsgSucess - NotFound - AlreadyExists - VersionMismatch - RangeError - LargeResult - IncompleteData - InvalidData - FunctionUnsupported - NoMemory - SendFailure - Timeout - BadReqBody - BadReqParam - InvalidFieldFormat - UrlNotFound - ApiVersionNotSupported - Unauthorized - Forbidden - Conflict - NotModified - DependencyConflict - JsonFmtError - ProtoFmtError - CertError - DataBaseConnection - DBError - zMsgAccepted - zMsgCreated - PreConditionFailed - InternalServerError default: zMsgErrorNone description: |- - zMsgErrorNone: common validation errors - IncompleteData: message had fields that weren't filled in - InvalidData: message contained the field that wasn't expected - FunctionUnsupported: this feature unavailable on this version of device - InvalidFieldFormat: message contained the field that wasn't correctly formatted - JsonFmtError: Marshal / Unmarshal errors - DataBaseConnection: generic DB error title: ZedCould internal error code ZksSyncStatusCode: type: string enum: - ZKS_SYNC_STATUS_CODE_UNSPECIFIED - ZKS_SYNC_STATUS_CODE_HEALTHY - ZKS_SYNC_STATUS_CODE_PARTIALLY_HEALTHY - ZKS_SYNC_STATUS_CODE_UNHEALTHY default: ZKS_SYNC_STATUS_CODE_UNSPECIFIED ServerSyncStatus: type: object properties: serverName: type: string status: type: string error: type: string securitySchemes: BearerToken: type: http description: Bearer token for user session scheme: bearer ````