API REFERENCE
BACKEND AUTHENTICATION
Your backend supplies X-API-Key. Never put the customer key in browser code or accept it as your application's user authentication. Use your own authenticated user identity before issuing a session.
curl -X POST "$ASTACK_API_ENDPOINT/session" -H "X-API-Key: $ASTACK_API_KEY" -H "Content-Type: application/json" -d '{"userId":"authenticated-app-user","idempotencyKey":"stable-request-id"}'
POST requires session_create permission. Repeat the same request and idempotency key after a 202 response until 200 returns session connection fields. The Developer SDK handles this waiting.
SESSION ROUTES
These session routes are available through the deployed session function and Developer SDK 0.5.0.
| Method | Path | Permission |
|---|---|---|
| POST | /session | session_create |
| GET | /session/:id | session_manage |
| GET | /session?limit=50&offset=0 | session_manage |
| DELETE | /session/:id | session_manage |
GET/list return customer-owned status and usage without credentials or runtime metadata. Another customer's ID returns 404. DELETE performs final billing once and releases the exact owned allocation. A repeated DELETE is safe; 503 means cleanup must be retried. Unsupported methods return 405 and never create a session.
Lists accept limits 1–100 and nonnegative integer offsets. DELETE accepts an optional last_error string of at most 500 characters. Account, billing, worker, admin, validate-key and outbound session-webhook endpoints are not part of this HTTP API.