Mint a short-lived Use lease onto an existing agent. Token is in this response once. Sandbox gets the session file, not the agent JWT. Default 15m, max 1h. Not MCP.
POST
/v1/sessionsAuthorization
AuthorizationBearer token (JWT) · headerrequiredHydra JWT. Identity is the bound agent or a Keto member human. The host is not identity.
Request body
requiredapplication/jsonagentstringrequiredttlstringGo duration. Default 15m. Max 1h.
max_usesintegerMaximum successful Use calls. 0 = unlimited.
Responses
200Session plus token once.
idstringrequiredorg_idstringrequiredagent_idstringrequiredexpires_atstring<date-time>requiredcreated_atstring<date-time>requiredrevoked_atstring<date-time> | nullrenewed_atstring<date-time> | nullttlintegerrequiredmax_ttlintegerrequiredmax_usesintegerrequiredusesintegerrequiredUse calls that passed authorization and reached upstream consumption.
tokenstringrequired400bad request
401missing or invalid Bearer
403not owner
Request
curl -X POST "https://veil.nyc/v1/sessions" \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"agent": "string",
"ttl": "string",
"max_uses": 0
}'const response = await fetch("https://veil.nyc/v1/sessions", {
method: "POST",
headers: {
"Authorization": "Bearer YOUR_TOKEN",
"Content-Type": "application/json"
},
body: JSON.stringify({
"agent": "string",
"ttl": "string",
"max_uses": 0
})
});import requests
response = requests.post(
"https://veil.nyc/v1/sessions",
headers={
"Authorization": "Bearer YOUR_TOKEN",
"Content-Type": "application/json"
},
json={
"agent": "string",
"ttl": "string",
"max_uses": 0
},
)Response
{
"id": "string",
"org_id": "string",
"agent_id": "string",
"expires_at": "2024-01-01T00:00:00Z",
"created_at": "2024-01-01T00:00:00Z",
"revoked_at": "2024-01-01T00:00:00Z",
"renewed_at": "2024-01-01T00:00:00Z",
"ttl": 0,
"max_ttl": 0,
"max_uses": 0,
"uses": 0,
"token": "string"
}bad request
missing or invalid Bearer
not owner