# Who a session belongs to

`POST /customer-accounts/auth/session` · Rivier · contacts

Who a session belongs to. Send the access token, or the refresh token when it has run out; a refresh answers new tokens (the old refresh token then stops working).

- Scope: contacts:write
- Sdk: contacts.customerAuth.session
- Cli: contacts customer auth session

## Request body

`application/json`

```json
{
  "type": "object",
  "properties": {
    "project": {
      "type": "string",
      "minLength": 1,
      "maxLength": 80
    },
    "access": {
      "type": "string",
      "maxLength": 2000
    },
    "refresh": {
      "type": "string",
      "maxLength": 200
    },
    "ip": {
      "type": "string",
      "maxLength": 64
    },
    "userAgent": {
      "type": "string",
      "maxLength": 200
    }
  },
  "additionalProperties": false
}
```

## Responses

- `200`: Success
- `400`: The request was malformed
- `401`: No valid credential
- `403`: The credential lacks the scope, origin or address
- `429`: Over the key's rate limit; see Retry-After

## Example

```sh
curl -X POST 'https://api.rivier.ai/customer-accounts/auth/session' \
  -H 'Authorization: Bearer $KEY' \
  -H 'Content-Type: application/json' \
  -d '{
  "project": "string",
  "access": "string",
  "refresh": "string",
  "ip": "string",
  "userAgent": "string"
}'
```