**Language / Язык:** [English](session.md) | [Русский](../ru/domains/session.md)

# Session

Durable session identity shared by REST and SOAP:
[`app/vsphere/security/session.py`](../../app/vsphere/security/session.py).

## Endpoints

| Method | Path | Notes |
|---|---|---|
| POST | `/api/session` | Basic auth → JSON string session id + `vmware-api-session-id` header/cookie |
| GET | `/api/session` | HTTP 200; `x-vmware-session-user` / `x-vmware-session-roles` headers |
| DELETE | `/api/session` | Invalidates the session, clears cookie |
| POST/GET/DELETE | `/rest/com/vmware/cis/session` | Legacy `{ "value": … }` equivalents |
| POST | SOAP `SessionManager.Login` | Returns the same session id; sets `vmware_soap_session` cookie |
| POST | SOAP `SessionManager.Logout` | Deletes the session |

## Highlights

- Sessions are opaque 32-char hex tokens stored in `vsphere_sessions` with a
  **2-hour sliding TTL** — every authenticated call extends `expires_at`.
- The four lab credentials (`vsphere_credentials`, scrypt-hashed) are
  idempotently ensured on first login and by every seed profile
  (`ensure_default_credentials`).
- `require_session` resolves the session from either the
  `vmware-api-session-id` header or cookie; missing/expired → HTTP 401.
- Roles are attached to the session at lookup time
  (`vsphere_credentials.roles`) and drive [Authorization](authz.md).

See [Authentication](../authentication.md) for full request examples.