Skip to main content

Ci Session Exchange

POST 
/auth/ci-session-exchange

Mint a real, cookie-authenticated session from a Partner API Key.

Unlike test-login above, this is NOT an auth_enforced=0 bypass -- it is reachable precisely WHEN auth_enforced=1 (staging, same as production), gated only by ci_session_exchange_enabled (default False, hardcoded False in production's deployment config -- see infra/azure/modules/ api.bicep and auth.validate_startup_config()'s matching boot-time refusal, the same belt-and-suspenders pattern already used for e2e_enabled).

Exists to solve one problem: azure-deploy-target.yml's staging-e2e- console-v2 job needs a real, valid session to drive authenticated Playwright journeys against a hardened deployment, and the only other source of one (a real OIDC login) is an 8h-lived credential with no automated refresh path (scripts/smoke-live-deployment.py's tier 2 docstring). Rather than inventing a new credential primitive, this reuses Partner API Keys (services/partner_api_key_store.py) -- already a database-issued, hashed-at-rest, tenant/role-bound, instantly- revocable mechanism this codebase built for exactly "a machine needs durable, real access to a hardened deployment." The session minted here can never exceed the bound key's own roles/tenant -- this endpoint adds no privilege beyond what the key already grants through every other partner-key-authenticated route.

Never accepts a session cookie or any other credential as input -- Authorization: Bearer <halo_live_/halo_test_/halo_customer_ key> only, resolved through the exact same resolve_partner_api_key() path every other partner-key-authenticated request already uses.

Request​

Responses​

Successful Response

Response Headers
    Idempotency-Replayed

    true when this response was replayed from the idempotency cache for a repeated Idempotency-Key instead of re-executing.

    RateLimit

    Current tenant quota state (draft-ietf-httpapi-ratelimit-headers structured field): "tenant";r=<remaining>;t=<seconds-to-reset>. Emitted on every response when per-tenant rate limiting is enabled (ARMOR_TENANT_RATE_LIMIT_PER_MIN > 0; off by default).

    RateLimit-Policy

    The quota policy the RateLimit header reports against: "tenant";q=<limit>;w=<window-seconds>.

    X-Correlation-Id

    Request correlation id — present on every response; quote it when reporting an issue. Error bodies carry the same value as correlation_id.

Was this helpful?

Optional comments unlock after a short time on this docs site.

Ask the docs

Tier-scoped answers from this portal corpus (extractive; no external LLM).

Comments

Loading comments…

Suggest an edit

Propose a correction. Staff review every suggestion and open a draft PR; nothing publishes without CI.